Incident contact sheet (printable)
A fill-in sheet of everyone you will need to reach during a cyber incident, from your own decision-makers to your insurer, bank and regulators. Print it, fill it in by hand, and keep copies away from your computers.
Print it and fill it in by hand, or work through it on screen. Want a second opinion on your answers? Call or send us a message and we will go through them with you.
How to use this sheet
Print this page (Ctrl+P or Cmd+P) and fill it in by hand. Nothing you write is entered or stored on this website. When ransomware or a hijacked mailbox takes out email, Teams and your shared drive, the contact list saved in those systems goes with them, so this sheet is meant to live on paper and on personal phones.
Fill in names, mobile numbers and a personal or alternate email for each role. Mark who can make which decisions. Review it every quarter and whenever someone in the list leaves. A sheet that is two years out of date sends the first calls of an incident to people who no longer work for you, at the moment every minute matters.
Internal contacts
| Role | Name | Mobile | Alternate email / channel | Can authorize |
|---|---|---|---|---|
Incident lead (runs the response) | Blank | Blank | Blank | Containment, outside help |
| Deputy incident lead | ||||
Owner / CEO | Blank | Blank | Blank | Payments, public statements |
Finance lead | Blank | Blank | Blank | Bank holds, payment stops |
Privacy officer | Blank | Blank | Blank | Breach assessment |
HR lead | Blank | Blank | Blank | Staff communications |
Communications / client relations | Blank | Blank | Blank | Client messages |
External contacts
| Who | Name / firm | Phone (24/7 if any) | Notes | |
|---|---|---|---|---|
IT provider or internal IT | Blank | Blank | Blank | After-hours number? |
Incident responder / forensics | IT Rapid Support | (289) 582-9930 | Blank | 24/7 incident line |
Cyber insurer claims line | Blank | Blank | Blank | Policy number below |
| Insurance broker | ||||
Legal counsel | Blank | Blank | Blank | Privacy / breach counsel? |
Bank fraud department | Blank | Blank | Blank | For wire recalls |
Domain registrar / DNS host | Blank | Blank | Blank | Account holder |
| Key software vendors (accounting, practice management) | ||||
| Internet provider / phone provider | ||||
Account and policy numbers to have ready
These are the details people ask for in the first hour. Write the location of each, not passwords. Passwords never belong on this sheet.
- Cyber insurance policy number and the notice requirements in the policy
- Bank account numbers for operating and trust accounts, and the bank's fraud reporting process
- Microsoft 365 or Google Workspace tenant name and where the emergency admin (break-glass) credentials are kept
- Domain registrar account holder and where its recovery details are kept
- Backup provider and how to request a restore
- Location of the incident response plan and network diagram
Regulators and reporting
Who you report to depends on what happened and whose information was involved. Your counsel decides formal notifications; this list is so the numbers are at hand.
| Organization | When it may apply | How to reach |
|---|---|---|
Local police | Any crime, and first call in an emergency | Your local non-emergency line; 911 for emergencies |
Canadian Anti-Fraud Centre | Fraud and cybercrime, including payment fraud | reportcyberandfraud.canada.ca or 1-888-495-8501 (weekday hours) |
Canadian Centre for Cyber Security | Cyber incidents affecting Canadian organizations | cyber.gc.ca, 'Report a cyber incident' |
Office of the Privacy Commissioner of Canada | PIPEDA breaches with a real risk of significant harm | priv.gc.ca breach report form |
Provincial privacy regulator | Quebec, Alberta, BC or Ontario health information | Write in: ______________ |
Professional regulator | If your licence or profession requires it | Write in: ______________ |
Keep it offline
Print and fill in by hand
Or fill a copy in a document stored outside your main systems, then print it.
Distribute copies
Office, home copies for decision-makers, and phone photos for everyone on the call tree.
Review quarterly
Call two numbers at random each quarter to confirm they still work.
Update after changes
New insurer, new bank, staff departures, new IT provider: update the sheet the same week.
Related.
- GuideOut-of-band communications and incident call treeWhen an attacker is inside your email or Teams, using them to coordinate the response tells the attacker your plans.
- GuideWriting an incident response plan that works for a small organizationA usable incident response plan is short enough to read under stress and specific enough to act on.
- ServiceIncident ResponseA 24/7 line to responders who contain first, preserve evidence second and explain everything.
- PracticeCyber Forensics & AssuranceIncident response, digital forensics, penetration testing and independent attestation.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.