Preparation decides how the first hour goes. Know who leads, who decides and who to call. An incident plan should fit on a few pages and be available offline.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Name an incident lead and a deputy
- Keep contact lists for providers, insurers and authorities
- Store the plan where you can reach it if systems are down
Next steps
Test the plan with a tabletop exercise twice a year. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.