
Incident response
Preserve relevant evidence, contain the issue, and assess affected data and functions. Recovery should address the cause rather than restore an infected copy. Leave the team with a decision, an owner, and a review date.
Test clean backups and key customer journeys after restoration. Set monitoring and ownership for later signs of recurrence. Use a real test inquiry to check delivery and follow-up.
- A written brief
- Named responsibilities
- Agreed review points




