Home / Commons / Incident plan builder

Tool

Your first hour, on one page.

Answer a few questions and get a one-page incident plan to print and keep away from your network: who decides, who to call, what to disconnect, where the backups are.

FreeNo sign-upNothing leaves your browserPrints on one page

The builder needs JavaScript, which is turned off. Below is the blank plan instead: print it with your browser’s Print command and fill it in by hand.

Free, no sign-up. Nothing you type leaves your browser. Your draft is saved in this browser only, so you can come back to it. Use Clear everything when you are done, especially on a shared computer.

01Your organization
02Who decides

One person makes decisions in the first hour. Name a deputy for when they can’t be reached.

03Who to call

Use numbers you can reach from a mobile phone, out of hours.

Cyber insurer

Many policies require you to call the insurer before you hire anyone to help. If you have no cyber insurance, leave this blank.

IT help

National cyber security agency

Bank

Lawyer

Anyone else

04What to disconnect

Disconnect from the network, don’t switch off: switching off can destroy evidence.

05Where the backups are

A backup ransomware can reach is not a backup. See the field guide.

06Reaching staff without email

Assume email and chat may be compromised or down.

07If personal data is involved

If personal, health or financial records may be involved, you may have legal duties to notify the people affected or a regulator, often within a set time. This is general information, not legal advice.

Your plan

Fills in as you type.

First-hour incident plan

Organization:

Updated
Printed copies kept

If you think something is wrong, start here

  1. Disconnect, don’t switch off. Unplug affected devices from the network or turn off Wi-Fi. Leave them powered on.
  2. Move to phones. Assume email and chat may be compromised.
  3. Call the incident lead. They decide. If they can’t be reached, the deputy decides.
  4. Call the insurer before hiring help. Then report to the national agency.
  5. Write everything down. What you noticed, when, and what you did.
  6. Don’t pay, delete or negotiate alone. Take advice first.

Who decides

Incident lead
Deputy

What to disconnect

    Who to call

    ForWhoNumber or address
    Cyber insurerPolicy
    IT help
    National agency
    Bank
    Lawyer
    Also call

    Where the backups are

    Kept
    Who can restore
    Last restore test

    Reaching staff without email

    How
    Contact list kept

    If personal data is involved

    We hold
    Who must be told
    Advice from

    Keep printed copies away from the office network. Update this page when people, suppliers or systems change.

    Made with the free incident plan builder at moraph.org/commons/incident-plan. General information, not legal advice.

    Tip: in the print dialog, choose “Save as PDF” to keep a copy, and turn off headers and footers for a cleaner page.

    Before you need it

    A plan you’ve never walked through is a guess.

    Read the plan aloud with whoever would be in the room. Check that every number is right and reachable out of hours, and that the deputy knows they are the deputy. The first-hour checklist explains each step, and the incident contact sheet template holds the longer list of contacts.

    Shield, Moraph for Good’s security program, can help eligible organizations write and rehearse their plan with a tabletop exercise.

    Apply for Shield Take the self-assessment