Build an incident contact plan
Use the reporting and escalation route agreed with your IT provider, incident-response provider and insurer. Keep those contacts and decision authorities available before an event occurs.
Minnesota based · Preparing for launch · Scope agreed before work begins
Who should a business call first during a suspected incident?
Apply the answer to your business
If a key email account is unavailable, a contact plan stored only in that mailbox may be difficult to reach. Discuss an appropriate way for authorized people to access essential contact details during a disruption.
This is an illustrative situation, not a reported CX client engagement.
Turn the question into a next action
Choose the business decision you need, involve the person responsible for the system and record what is known versus what needs validation. Keep the follow-up small enough that it has a named owner and a clear finish line.
- Ask your teamWho has authority to engage response help?
- Ask your teamWhat reporting route does the insurer require?
- Ask your teamHow can authorized staff reach contacts if email is unavailable?
Evidence to bring to the conversation.
Use the agreed scope to decide which records are relevant. These items can help the business and technical owners establish a common starting point:
- An approved contact list
- Decision and escalation responsibilities
- Provider and insurer instructions
Missing evidence is an open question to document. It is not a reason to invent an answer or assume that the underlying system is protected.
Know the boundary
CX’s public enquiry mailbox is not an emergency incident channel. This educational page does not provide live containment instructions.
Published by CX Cyber Security · General education · Updated October 31, 2026. Further reading: NIST: responding to a cyber incident. CX’s original guide is not a NIST assessment or endorsement.
Plan your next step
Start with the business.
Get clear on the risk.
Tell us what your company does, the size of your team and what prompted your enquiry. We’ll discuss fit and the scope needed before proposing work.
Preparing for launch. Enquiries are welcome; delivery dates and engagements require finalized onboarding and a written agreement. Please do not email passwords or sensitive security evidence.