How to develop a cyber incident response plan

Define the purpose of your plan, its scope, and who it applies to. Make sure to also identify the types of incidents covered, like ransomware attacks, data breaches, or system outages.

Establish criteria for evaluating an incident’s impact on operations, data, customers, and reputation.

Designate an incident response team and document each member’s role, responsibilities, and decision authority, including primary and backup decision makers.

Remember to also maintain an up-to-date contact list with names, roles, phone numbers, and emails, including key external partners such as IT and legal.

Keep a record of important systems, their owners, how these systems are connected to each other, and what they do for your business.

For more information on how to help secure systems and devices across your organization, visit the Security best practices for businesses or the Security best practices for commercial and corporate clients guidance.

Define short- and long-term strategies to contain incidents, including when to use offline backups and engage in continuity measures to maintain critical operations.

As a part of your strategy, document how and when employees, customers, partners and regulators should be notified about different types of incidents.

If the issue involves Wells Fargo accounts, visit the Wells Fargo Report fraud or suspicious activity page.

Capture what happened, assess what worked, and identify improvements. Use insights to update the response plan and stay prepared.