What the plan is for
When something goes wrong, the plan tells people who is in charge, who to call, what to do first and what to record. Auditors ask for it, and so do customers in security reviews.
What to put in it
- Roles: an incident lead, a technical lead, a communications owner, with deputies.
- Severity levels: two to four, each with a plain description and who must be told.
- First steps: contain, preserve evidence, start a timeline.
- Notification: which customers, regulators and partners must be told, and by when. Contracts and laws set deadlines.
- Contacts: names and numbers that work outside office hours.
- After the incident: a short review of what happened and what changes.
Keep it short
A plan of a few pages that people know beats a long document nobody has opened. Put detailed technical runbooks in separate documents and link to them.
Practise it
Run a tabletop exercise at least once a year: walk through a realistic scenario, such as ransomware or a lost laptop, and note what was unclear. Record who took part and the gaps you found; that record is evidence an auditor will ask for.
In Doniastack
Incidents are logged with severity and reporting deadlines, and tabletop exercises are recorded with their outcomes and gaps, so the plan and the proof live together.
Get started
See where you stand in 30 minutes
Tell us which review or audit is in front of you. We'll walk you through the platform and map what readiness takes, with no obligation.