What to Put on the One-Page Incident Card by the Phone

Published October 23, 2026 · Last reviewed October 23, 2026

Why paper

A response plan stored on the file server is inaccessible when the file server is the problem. Email may be down or watched by the intruder. The card solves a narrow problem: during the first confusing hour, anyone in the office can find the first steps and the right numbers without searching. It does not replace a full plan. The detail behind the card is in the first-hour guide.

Block one: the first five steps

1. Stop using the affected computer. Unplug its network cable or turn off Wi-Fi. If you cannot disconnect it, power it down.
2. Do not delete, wipe or restart anything else, and do not pay anyone.
3. Write down what you saw, the time and who saw it.
4. Phone the people on the call list below, in order. Use a phone, not email.
5. Tell your manager. Do not discuss the incident on company email or chat.

Block two: the call list

Print this as a table with a blank line for the name and number on each row, and fill it in by hand.

1. Cyber insurer claims hotline: ____________   Policy number: ____________ (insurers often control who is authorised to respond, so this comes first).
2. IT provider or MSP, out-of-hours number: ____________
3. Legal counsel: ____________
4. Bank fraud line, for payments: ____________
5. Owner or senior manager (mobile): ____________
6. National reporting body: FBI IC3 (ic3.gov) in the United States; Canadian Centre for Cyber Security (cyber.gc.ca) and the Canadian Anti-Fraud Centre in Canada.

Block three: facts a responder will ask for

Responders usually need basic facts in the first call. Collect these in advance and write them on the card or on a sealed page attached to it:

• The name of your email and identity platform, and who holds its administrator accounts.
• Where your backups are held, and who can reach them.
• The registrar for your domain name and who holds the login.
• The number of staff and sites, and which systems the business cannot trade without.
• Your cyber insurance broker’s name and number.

Do not write passwords on the card. If emergency access details must be kept on paper, put them in a sealed envelope in a safe, with a named person responsible for it.

Block four: what not to do

• Do not click, open or forward the suspicious message again.
• Do not reply to a ransom note or a payment-change request.
• Do not reset all passwords from an affected computer.
• Do not talk to the press or customers until counsel has advised.

Keeping it alive

A card that is out of date is worse than none, because it sends people to the wrong number. Put a review date at the bottom and diary the check each quarter, ideally in the same meeting as your IT provider review (see questions to ask your IT provider this quarter). Run a ten-minute walkthrough once a year: hand the card to someone who has never seen it, tell them a laptop shows a ransom note, and watch what they do. Fix whatever confuses them.

The structure follows the preparation and response phases in public guidance such as the CISA ransomware guide. Your insurer or counsel may want additions, so ask them to review the draft.