IRP

Incident Response Plan

In plain language

A written plan for what to do, who to call and in what order when a security incident happens.

The metaphor

Like the fire escape plan posted by the door: when smoke appears, nobody has to stop and decide.

Going deeper

How it works

It names a person in charge and a backup.
It lists the first steps: isolate, call IT, preserve evidence, tell the insurer.
It includes who to inform, such as clients, insurers and authorities, with a note to check the rules that apply.
It is rehearsed once a year.

What can go wrong (example scenario)

A seven-person firm discovered ransomware on a Friday evening. Nobody knew who to call, and staff kept using the infected computers all night, spreading it to the backup drive.

How WILDCARD handles it

An incident response plan is a vCIO output.

In practice

A firm keeps a printed contact sheet in a drawer.
An office practises one scenario each year.
An owner knows when to call the insurer.

A question owners ask

What is the first line of the plan?

Disconnect the affected device from the network, and call the number on the sheet.

Where WILDCARD handles this

✨

vCIO

Fractional CIO on retainer
Moonlight, Sunlight, Starlight tiers
Credits for single outputs

Start with vCIO

Related terms

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →