Here’s what the first hour of a security incident looks like without a plan: someone notices something wrong, tells someone else, a group chat forms, three people start fixing three different things, nobody calls the insurer, someone reboots the very machine that held the evidence, and the owner hears about it after lunch. Every one of those missteps is normal, human, and expensive — and every one is prevented by a single page written on a calm afternoon. Not a binder. A page. Here’s what goes on it — and if you’d rather start filling in blanks than staring at a blank one, download our one-page fill-in template (PDF), which follows this article section for section.

Why one page beats the binder

Incident response plans fail in two directions: the business that has nothing, and the business with a 40-page template downloaded during an insurance renewal, unread since. Under stress, people don’t consult binders — they follow the shortest credible instruction available, which is usually the loudest person in the room. The plan’s job is to be that shortest credible instruction: who to call, in what order, who decides, first moves. Everything else is appendix.

Section 1: The call list, in order

Names, numbers, backups for each — the order matters:

  1. Internal incident lead — the one person (plus a backup) who runs the response and makes the calls below. Not a committee; incidents punish committees.
  2. Your IT provider or team — the 24/7 emergency number, not the ticket portal. (Clients of ours: this call also triggers the MDR side, which may already be mid-containment.)
  3. Cyber insurer’s breach hotline — early, for anything that smells like a security incident, because most policies require prompt notice and late notice jeopardizes claims. Insurers also bring the cavalry: breach counsel and forensics, often required to be their panel — another reason to call before hiring anyone.
  4. Attorney — with one trigger rule in bold: if personal data may be involved, counsel is called before any external statement. Breach-notification laws in Oregon, Washington, and everywhere else run on clocks that start at discovery.
  5. Bank fraud line — pre-listed, because when money moves fraudulently, recovery odds decay by the hour.

Section 2: Who decides

Three sentences that prevent the worst mid-crisis arguments: who can authorize shutting down systems (weighing hours of downtime against containment — a downtime cost figure makes this decision rational instead of loud); who speaks externally — one name, per the communication plan; and who can spend emergency money without a meeting, up to a stated amount.

Section 3: First moves for the three likely scenarios

Five lines each, not procedures — the goal is preventing the classic first-hour mistakes:

Ransomware / files encrypting: Disconnect affected machines from the network — do not power them off (memory holds evidence responders need). Don’t touch the backups until IT confirms the immutable copy is intact. Call list, top to bottom. Don’t communicate with attackers or pay anything before insurer and counsel are in the room. (The fuller playbook.)

Compromised email account: Reset the password and revoke active sessions, check for new forwarding rules and recent sends, warn anyone the account may have contacted, and treat every message it sent as suspect.

Money sent to a fraudster: Bank first — recall request, receiving-bank contact — then ic3.gov the same day, then insurer. Hours matter more here than anywhere else in this document.

And above all three, the standing rule for every employee, the same one from the training program: see something, say something immediately, zero blame. The plan only activates as fast as the first report.

Section 4: Where the page lives

Printed — several copies, including one off-site, because the plan stored only on the server it describes is a genre of joke IT people tell each other. Digitally, somewhere reachable when company systems aren’t (personal phones of the three key people is fine). And dated, reviewed yearly: phone numbers rot, insurers change, the annual review takes ten minutes.

Then, once a year, spend one hour making it real: a tabletop walk-through — “it’s Monday 7 a.m., the ransom note is on the warehouse screen, go” — read the page aloud, follow it, and fix what stumbles. The first tabletop always finds something: the number that changed, the decision nobody owned, the backup nobody could locate. Finding it costs an hour on a Tuesday; the alternative venue is the real thing.

The bottom line

An incident response plan isn’t a compliance document — it’s the shortest set of instructions that keeps the worst hour of your year from compounding itself: who to call in order, who decides, first moves, printed and rehearsed. One page, one afternoon to write, one hour a year to test. Few documents in your business will ever have a higher ratio of importance to length. The template is waiting whenever the calm afternoon arrives.