Decide who can act
A suspected compromise can move faster than an approval chain. Define who may isolate a system, disable an account or activate the incident team. Identify alternates and a route for urgent decisions outside working hours. Make the authority clear before the pressure of a real event.
Agree which services matter most
A technical inventory alone cannot determine recovery order. Work with business owners to identify critical services, dependencies and tolerable interruption. Validate that the recovery assumptions reflect available people, technology and supplier support. A documented recovery objective is useful only if it can be tested and supported.
Prepare communications
Identify the people responsible for internal updates, customers, suppliers and external enquiries. Prepare approval routes and alternative communication channels. Confirm reporting obligations with the relevant compliance and legal owners for your entity. Avoid generic reporting deadlines that have not been checked against the incident and applicable requirements.
Know when to call for help
Agree escalation criteria for specialist incident response, forensic support, legal advice and key technology suppliers. Record contact paths and contractual arrangements in a place that remains available during an outage. Consider how evidence will be preserved without delaying urgent containment decisions.
Exercise the decisions
Run a short tabletop using a plausible scenario: an unavailable business application, a compromised administrator account or ransomware affecting a supplier. Ask participants to make actual decisions, rather than simply read the plan. Record unclear authority, missing information and recovery dependencies. Finish with a small number of owned actions and a date to check they have been completed.
This article provides general guidance. Scope and applicable obligations should be confirmed for your organisation.