Module 8 · 8.1

English

Nederlands English Deutsch

An incident plan and an incident card

Module 8: When things go wrong · Reading time: 10 minutes

Learning objective: After this lesson you can create an incident card and a simple incident plan that still work even if your computers, email and phone list are unreachable.

Key concepts: incident, incident card, incident plan, roles, contact list, containment, preserving evidence, communication, keeping things offline, practising (tabletop)

Why you sort this out now, not when the fire starts

Imagine it's Monday morning, 07:45. On the till computer at Bakkerij Example there's a red screen saying all files have been encrypted. The shared folder with the orders won't open. Someone says, "Call the computer guy." But his number is in the contacts of the mailbox, and the mailbox is on that same computer. Someone else wants to switch the computer off straight away. A third person starts plugging in the backup drive to "restore everything".

All three reactions are understandable, and two of them make things worse. That's almost always how it goes: under pressure, people do whatever comes to mind first. An incident is any event that threatens the availability, reliability or confidentiality of your data or systems: a hacked email account, ransomware, a lost laptop, an email with customer data sent to the wrong person, a hijacked website.

The goal of a plan isn't that everything goes well. The goal is that in the first hour you don't make mistakes you can't undo, and that you know who to call.

Incident card and incident plan: the difference

	Incident card	Incident plan
What	One sheet of paper with the first steps and the numbers	A few pages with roles, agreements and an approach per type of incident
For whom	Everyone in the business	The owner or the person who handles IT
Where	On paper, on the wall near the printer, in a drawer, as a photo on your phone	On paper and digitally, with a copy kept outside the business
When	The first few minutes	The first hours and days

For a business with two to twenty people, the card is the most important part. The plan can be short. The NCSC has a detailed incident response plan for ransomware (see Further reading); you can use that as a starting point and shorten it.

What goes on the incident card

A good card answers five questions. Below is a template you can copy.

INCIDENT CARD  Bakkerij Example            version: 1   date: ..-..-....

1. NOTICED SOMETHING STRANGE?  (red screen, odd email sent, can't log in,
   unknown payment, laptop lost, data sent to the wrong recipient)
   -> Report it IMMEDIATELY to: ............................  tel: ...............
      Backup contact: ..........................................  tel: ...............
   Reporting is always the right thing to do. No one gets blamed.

2. FIRST STEPS (don't try to fix it yourself)
   [ ] Unplug the network cable / turn off wifi / enable aeroplane mode. DO NOT switch off.
   [ ] Disconnect USB and backup drives. DO NOT connect them.
   [ ] Take a photo of the screen (with your phone).
   [ ] Write down: the time, what you saw, what you did.
   [ ] Don't pay, don't reply to the extortionist.

3. WHO DO WE CALL?
   IT support / administrator   ............................  tel: ...............
   Hosting / email              ............................  tel: ...............
   Bank (fraud, 24/7)           ............................  tel: ...............
   Insurer (cyber)              ............................  policy: .............
   Police (report a crime)      0900-8844
   Data protection authority's data breach notification desk  (within 72 hours)
   Key customer/supplier: ...................  tel: ...............

4. WHO DECIDES AND WHO TALKS?
   Decides (switching off, restoring, reporting, paying): ..........................
   Talks to customers, press, staff: ........................................
   Keeps the logbook: .....................................................

5. WHERE IS WHAT?
   Backups: .............................. (last test: ..-..-....)
   Password manager emergency access: ...........................................
   List of systems and accounts: ..........................................
   This plan (digital) + copy kept outside the business: ..............................

A few choices in this template deserve some explanation.

"Don't switch off, do disconnect." For ransomware, the NCSC advises disconnecting an affected device from the network straight away (cable, wifi, mobile network), but not switching it off; sleep mode is fine. The working memory holds traces an investigator may need, and sometimes even keys. Disconnecting stops the spread to other devices and to the network drive.
"Don't connect backup drives." A drive you plug into an infected computer gets encrypted too. You first need to be certain the environment is clean (lesson 8.3).
"Reporting is always the right thing to do." The employee who notices something first is your best defence. If they're afraid of getting told off, they'll hold back and you'll lose hours. See also lesson 9.2.
Numbers on paper. Especially in a major incident, your email, your shared calendar and sometimes even your phone system won't work. A card that only exists in the cloud is then unreachable too.

In the Netherlands, 0900-8844 is the general non-emergency number for the Dutch police; businesses use it to arrange an appointment to report a crime. In a direct emergency you call 112, but a cyberattack is usually not a 112 matter.

Roles: who does what

In a small business, one person is often everything. Still, agree on three roles, even if two of them have the same name attached:

The decision-maker. Decides on switching off, restoring, reporting a data breach to the data protection authority, contacting the bank, and whether to bring in an outside specialist. Ideally the owner or director, with a fixed deputy.
The technical lead. Your IT supplier, web developer or the handy colleague. Does what the decision-maker asks and advises them. Agree in advance whether your IT supplier also helps during an incident, how quickly, and what it costs; that's a question for lesson 7.2.
The communicator. Talks to customers, staff and possibly the press, so that one consistent story goes out. In the case of a data breach, this also includes informing the people affected (lesson 8.2).

Also appoint someone to keep a logbook: the time, what happened, who decided what. It may seem bureaucratic, but you'll need it for the report to the data protection authority (which asks when you discovered the breach and what you did), for your insurer, for reporting the crime, and for the evaluation afterwards.

The plan: a few rules per type of incident

Alongside the card, write a short approach for each common type of incident. Four are enough to start with:

Incident	First steps	Next
Email account taken over (odd emails sent, password doesn't work)	Change the password from a different, clean device; log out of all sessions; check forwarding and filter rules; turn on 2FA	Warn your contacts; find out which emails were read or sent (possible data breach, lesson 8.2)
Ransomware	Disconnect, don't switch off; disconnect backups; call IT support; don't pay	Lesson 8.3: investigation, clean recovery, reporting the crime, No More Ransom
Laptop or phone lost	Lock or wipe remotely; change the passwords of stored accounts; revoke sessions	Was the drive encrypted? If not: possible data breach (lesson 8.2)
Suspicious payment or invoice fraud	Call the bank immediately (a reversal sometimes only works if you're quick); call the supplier on a known number	Report the crime; was the supplier's mailbox or your own hacked? (lesson 1.2)

Also record which systems matter most, in order. For Bakkerij Example that's, for example: till and card payments, today's orders, email, bookkeeping, website. When recovering, you start at the top. See also RPO and RTO in lesson 6.3.

Practising: half an hour round the table

A plan nobody knows doesn't work. A tabletop exercise takes half an hour: you sit round the table with the people who have a role and act out a scenario, without touching anything. The facilitator (which can be you) describes step by step what happens.

Example: "It's Friday, 16:30. The bookkeeper gets an email from a regular supplier: the IBAN has changed, please send today's outstanding invoice of 8,400 euros to the new account number. What do you do?" And then: "It's Monday. The supplier calls: they haven't received anything." At each step, ask: who does what, who do you call, where's that number?

Afterwards, write down what was missing. It's almost always a phone number, a password only one person knows, or unclear ownership of who decides. Update the card and put the new date on it. Practising once a year and reviewing the card is a good rhythm for a small business, and also after every major change (new IT supplier, new bookkeeping software).

In practice: what it looks like

Include in your card the specific places where you can act quickly with your own suppliers. With WebOké, for example, that's: viewing and logging out of active sessions in My WebOké, the "My website has been hacked" step-by-step guide in the DirectAdmin manual, and restoring a backup. Other hosting, email and cloud providers have similar features; look them up before you need them, and write down where they are.

Summary

An incident card (one sheet of paper) makes sure everyone does the right thing in the first few minutes: report it, disconnect but don't switch off, don't connect backups, don't pay anything.
Agree on roles: who decides, who does the technical work, who communicates, who keeps the logbook.
Write a short approach for each common type of incident, and the order of your most important systems.
Keep numbers and the plan somewhere outside your computers too.
Practise for half an hour round the table each year and update the card.

Quiz

Exercise

Exercise D8.1: Your own incident card. Take the template from this lesson and fill it in for your own business: real names, numbers and locations. Print it, put it up, and take a photo for your phone. Then, with one colleague (or on your own), act out the IBAN scenario from this lesson in a quarter of an hour, and write down what you were missing.

Exercise D8.1: Your own incident card

Here's how to do it: (1) Copy the template below (the course page also offers it as a printable page; no input is sent to the server). (2) Fill in real names, phone numbers and locations. Call at least one number to check it's correct (for example your bank's fraud number, which is often on the back of your card or in the app). (3) Print the card, put it up in a fixed spot and take a photo for your phone. Keep a copy outside the business (at home or with someone you trust). (4) With one colleague, or on your own, spend a quarter of an hour acting out the IBAN scenario from the lesson (tabletop).

all five blocks filled in
at least one number called to check
card is up in a fixed spot
photo on phone
copy kept outside the business
tabletop exercise done
date of the next review in the calendar (in a year's time).

Which number or which access was missing during the exercise?

Who is your stand-in when you're not around, and do they know that?

What does an employee do if they see a ransom message at 22:00 and can't reach you?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing