
Incident response
Preserve relevant evidence, contain the issue, and assess affected data and functions. Recovery should address the cause rather than restore an infected copy. Use the findings to update the brief for the next stage.
Test clean backups and key customer journeys after restoration. Set monitoring and ownership for later signs of recurrence. Try the main customer task on a phone before signing off.
- A written brief
- Named responsibilities
- Agreed review points




