
Incident response
Preserve relevant evidence, contain the issue, and assess affected data and functions. Recovery should address the cause rather than restore an infected copy. Explain which task matters next and why it takes priority.
Test clean backups and key customer journeys after restoration. Set monitoring and ownership for later signs of recurrence. Check the destination as well as the message that sends people there.
- A written brief
- Named responsibilities
- Agreed review points




