
Incident response
Preserve relevant evidence, contain the issue, and assess affected data and functions. Recovery should address the cause rather than restore an infected copy. Turn the findings into a short list of actions and owners.
Test clean backups and key customer journeys after restoration. Set monitoring and ownership for later signs of recurrence. Check that a visitor can find the next action without guessing.
- A written brief
- Named responsibilities
- Agreed review points




