Make your incident contact list before you need it

A suspicious payment request arrives while the owner is away. An employee cannot open a shared drive. The person who normally handles computers is unavailable. These are hypothetical situations, but they expose a practical question: who would your team contact first, and how would they reach that person if business email stopped working?

A short incident contact list is a useful place to start. It belongs within a response plan, rather than replacing one. NIST's Small Business Quick-Start Guide recommends identifying response participants, their contact details, responsibilities and authority. Its examples include business leadership, technical support, legal advisers, the bank and insurance contacts.

Give each contact a job

The checklist below is SmartBuzzAI's editorial recommendation for a small business to discuss with its advisers. It is general readiness information, not legal advice, an incident response service or evidence of certification.

Start with a response coordinator and a backup. Write down who can gather reports, call outside help and ask leadership for decisions. A name alone is not enough: someone needs to know what they are expected to do when a report arrives.

Add the technical contact for your actual services. That might be an internal employee, an IT support company or a managed security provider. Confirm which systems they support, their after-hours route and whether emergency work requires a separate agreement. Record a fallback if the first provider cannot respond.

Include the person authorized to make business decisions, the bank's verified fraud contact and your insurance reporting route if you have relevant coverage. Add your legal adviser and whoever coordinates employee or customer communications. Ask each external provider to confirm its role before listing it as part of your response team.

Make the list usable without email

CISA's #StopRansomware Guide recommends maintaining and exercising incident response and communications plans, with hard-copy and offline versions available. It also describes using communication methods outside affected systems during response.

For your contact sheet, record the role, primary contact, backup, verified phone number, hours of coverage and last confirmation date. Add the approved alternate way to communicate if ordinary email or chat is unavailable. Agree on how callers will verify one another before discussing sensitive information or authorizing work.

Keep passwords, recovery codes and customer records out of this sheet. Ask contacts which business contact details may be shared and with whom. Restrict access to people who need the list, protect printed copies and remove obsolete versions when you update it. An emergency planning document still needs sensible privacy controls.

Rehearse one ordinary disruption

Try a short discussion exercise: business email is unavailable, the coordinator is away and an employee needs to report suspicious activity. Can the employee locate the reporting instructions? Can the backup find the provider's number without opening the affected mailbox? Who decides whether to interrupt normal operations?

Use an arranged test with participants; do not send surprise incident reports to emergency services or providers. Note unanswered questions and assign someone to fix each gap. A successful discussion is useful preparation, but it does not demonstrate that technical containment or recovery will work.

Put maintenance on someone's calendar

Give one person responsibility for confirming the sheet after staffing, provider or service changes and at a regular interval the business chooses. Keep a version date visible and tell staff where the current copy lives.

Use your advisers to establish reporting obligations and communication decisions for your business. This checklist supplies no universal notification deadline. The immediate goal is smaller and concrete: employees know where to report a concern, and the people responsible can reach appropriate help.