Incident response: what to get right first

It comes up on almost every project, usually later than it should. If you only fix one thing about incident response this quarter, make it the first item below.

The realistic threat for most small businesses is automated and opportunistic, not targeted. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

Start here

Decide who does what before something happens. Getting it slightly wrong is survivable. Ignoring it entirely is not. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Then this

Communicating early beats communicating perfectly. There is a version of this that is over-engineered, and it is worth avoiding. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

Eventually

Write up what happened while it is fresh. None of that requires a large budget, only a decision and someone to own it. Write the reasoning down alongside the decision, because the reasoning is what changes first.

How to tell if yours is fine

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about incident response before you move on:

• Someone can say what the current setup is without going to look
• Write up what happened while it is fresh — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.