Prepare Incident Contacts Before a Cyber Emergency

Environment and inputs: A tabletop cyber incident, a contact sheet stored outside the affected system and test alternate contact endpoints.

An incident response plan becomes easier to use when contact information and responsibilities already exist. NIST’s small-business resources connect response planning with recovery and business impact. Preparation should include practical access to the plan even when normal email or internal systems are unavailable.

What matters

• Identify internal decision makers and external technical support contacts.
• Record how responders will communicate if primary systems cannot be trusted or reached.
• Practise a realistic scenario and update the plan when the exercise reveals missing information.

Practical example: A small business rehearses a compromised email account scenario and checks how staff would reach its IT provider without using that mailbox.

One action today: Verify your emergency contact list and store an accessible copy outside the main system.