Steer
The incident rehearsal
An incident plan nobody has walked through is a document. The rehearsal is the walk-through, at your table: who decides what, who tells whom, where the way back is, what your firm does first.
The bad day, decided on a good one.
On the day a mailbox sends in your name or a server shows a ransom note, the technical side runs in a fixed sequence, and our engineers take charge of it. What slows a firm down that day is everything else: who may order systems switched off, who tells clients, the insurer, the authorities and the staff, who speaks for the firm, where the way back is. Those are your decisions, and they are easier to make before they’re needed. The rehearsal walks your leadership through them, with your incident plan on the table and a realistic scenario in front of you, and records what you decided. Afterwards the plan says who, not just what.
How it runs
One scenario, around your table.
Not a drill with alarms. A walk-through with the people who would have to decide, asking the questions the day would ask, in order.
-
The plan, read first
Your written incident plan goes on the table, or we write a first version with you before the rehearsal. Everyone who would decide on the day has read it.
-
A scenario your firm would recognise
A phishing mail that worked, a ransom note on a server, a laptop lost with client files on it: one realistic scenario, drawn from the incidents firms like yours have, walked through hour by hour.
-
Who decides what
Who may order systems switched off, who signs off a restore, who decides whether to pay and whether to report. The names go in the plan, with a deputy for each.
-
Who tells whom
Clients, the insurer, your regulator, the data protection officer, the staff: who speaks, in which order, with which facts. We supply the facts and the timeline; whether and when to notify is the firm’s decision, and its legal assessment stays with you.
-
Where the way back is
What is backed up, when a restore was last tested, how long a restore would take in the agreed order, and what the firm would work on in the meantime. Where the rehearsal finds a gap, it goes on the risk report.
-
The first hour
What each person does in the first hour: who calls us, how, and what they say; who stops using which systems; who starts the record. Then the plan is updated and the next rehearsal gets a date.
On record
On the decision paper.
- The incident plan as updated by the rehearsal: who decides what, with deputies
- Who tells whom, in which order, and who speaks for the firm
- The scenario walked through, and what the firm would do in the first hour
- The gaps found, each with an owner and a date on the risk report
- The date of the rehearsal, and the date of the next
Into your evidence file, next to the incident plan, for the day your insurer or a client asks whether it has been walked through.
What usually goes wrong without it.
-
A plan with roles, but no names
The plan says “management decides” and “IT informs”. On the day, management is in court and IT is us. Nobody has agreed who may say stop.
-
Notification decided under pressure
Whether to tell clients, the insurer and the authorities, and in which order, is decided for the first time at midnight with incomplete facts. Walked through once, the order is known, and only the facts are new.
-
A way back nobody has looked at
The plan assumes a restore. Nobody at the table knows how long it would take or what was last tested. The rehearsal asks, and the answer goes into the plan.
Also under Steer
- IT roadmap A 12- to 24-month plan tied to your projects, people and growth, reviewed regularly.
- Budget and costs What you spend, what it buys and where to save or invest, with licences sized to reality.
- Risk report What’s protected, what’s open and what it costs to close, in plain language for management.
- Vendor and contract reviews A second opinion on software, telecoms and support contracts before you sign or renew.
- IT planning for deals What a merger, carve-out or new entity means for IT, planned before the legal date.
Questions we get
Is this the incident plan insurers ask for?
Insurers ask for a written incident plan, and many ask whether it has been tested. The rehearsal gives you both: the plan with names, and a record that it was walked through, in your evidence file. Whether it meets a particular insurer’s wording is for you and your broker to judge.
How long does a rehearsal take?
One sitting at your table with the people who would decide, and a little preparation before: the plan read, the scenario chosen. It isn’t a technical exercise and doesn’t interrupt your systems.
Does the rehearsal mean the real day will go to plan?
No rehearsal can promise that, and we won’t. What it does is make sure the decisions that are yours are already made, the people know their part, and the gaps are known before the day. The technical response is ours and follows the same sequence every time.
Who decides whether to report an incident to the authorities?
Your firm does. We supply the facts and the timeline, in plain words, as quickly as we have them, and we help you tell the people who must hear it from you. The legal assessment of what has to be reported, and by when, stays with you and your lawyer or data protection officer.
Start
Who would decide at your firm, and would they know it?
In a first call we go through what your incident plan says today, who would have to decide on the day, and what a first rehearsal would walk through.
- No first level
- No surprises
- Pilot before you buy