A short guide to incident response

Every audit we run turns up some version of this. Everything we would tell a client about incident response in the time it takes to drink a coffee.

Security is a maintenance habit rather than a purchase, which is why it drifts. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

Why it matters

Decide who does what before something happens. The reasoning matters more than the rule, because the rule has exceptions. Doing this properly once is usually cheaper than doing it approximately three times.

What good looks like

Communicating early beats communicating perfectly. The teams that handle this well are rarely the ones with the biggest budgets. If it only works because one person remembers to do something, it does not work yet.

Where it usually goes wrong

Write up what happened while it is fresh. None of that requires a large budget, only a decision and someone to own it. The version that survives contact with a real deadline is the simple one.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about incident response before you move on:

• Someone can say what the current setup is without going to look
• Communicating early beats communicating perfectly — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.