The practice of downtime

The practice of downtime

So there’s less real downtime when an emergency strikes

Imagine a ransomware attack lands on your systems: a criminal threat is all anyone sees on their monitors, and your files are maliciously encrypted so they no longer contain anything usable.

Everyone at your operation is somewhat prepared for this event if you’ve invested in an Incident Response Plan (IRP) (because of the ubiquity of cyberattacks). An IRP first means that emergency roles have been assigned, and even non-technical people have a response sheet to follow to help your organization weather these kinds of storms.

But do you know what you think you know?

Sometimes we feel sure that we know something, but only when we are made to articulate it do we find our knowledge is either solid or surprisingly wanting.

This phenomenon is true about the quality of your IRP, too. So here’s a parallel to the testing that happens, or should, in large enterprises: turn off your computers, ask your office staff to bring out the printed one-to-two-page response sheet of your IRP, and see how they do following its instructions. Ask your staff to mark every place they hesitate or are unsure what to do. The goal is to make the IRP dependably useful and stress-free in what in real life is a difficult situation.

What’s on that IRP response sheet?

An IRP goes into detail about communications and severity escalation and covers everyone’s role and authority; few need that in the wake of an attack’s discovery. But every person needs the action items that apply to them. So the response sheet is a one-to-two-page summary printout of your IRP. Each staff member can quickly see what will help them at that time, such as:

• First actions: CISA’s general guidance treats containment as an early step; if taking the network offline isn’t immediately possible, unplug affected devices from the network or remove them from Wi-Fi. Call the IRP-appointed Incident Manager. The first actions that apply to your setup depend on what is connected to what and how your backups are reached, so have an IT pro confirm these steps.
• Contact information for the IRP’s appointed Incident Manager, Tech Manager and Communications Manager¹, each with a phone number, an alternate way to reach them (depending on the attack normal communications channels may be down), and a named backup.
• Escalation criteria: who to call next if there is no answer.
• Where the full IRP is kept.
• A short entry for each assigned role, so every reader has at hand what is expected of them and others.

What the marks will tell you

Marking up a response sheet is a lightweight take on standard plan review, adapted for a non-tech staff. Because every plan has things its writer thinks are clear, but a reader doesn’t, the marked-up pages may show you things like:

• A term or process-step the person couldn’t follow.
• A phone number they couldn’t confirm would work.
• A “call IT” without a definite name, number or backup for that role.
• A step they weren’t sure they were allowed to take like unplugging a machine.
• Anything that needed a physical key or password or other barrier to carry out.

Many of these are correctable – and that is the point of the exercise to make a tool that serves your organization well. Update the response sheet, tell staff what’s changed; CISA advises quarterly testing of your IRP.

Keep printed copies of the response sheets where all staff can access them. Don’t use conventional email (it’s not secure) to distribute a document as sensitive as an IRP or an IRP response sheet.

Don’t yet have an IRP?

The prevalence of attacks makes planning a necessity to avoid lengthy downtime or permanent business closure. Start your IRP by asking these questions:

• Who will hold each role (Incident Manager, Tech Manager and Communications Manager), and who is the backup for each role?
• What do staff do (like unplug a networking cable) until the Incident Manager responds?
• Who contacts your IT company if you have one? the cyberinsurer?
• How up-to-date are the backups, what is their schedule and when was restoration from backup last tested?

If you need help, Bryley can help prepare your team with both an IRP and periodic practice to minimize downtime in the case of an attack. To speak to Bryley’s Roy Pacitto please complete the form, below. Or you can email Roy at RPacitto@Bryley.com or reach him by phone at 978.562.6077 x217.

^{1 https://www.cisa.gov/sites/default/files/2025-09/Incident-Response-Plan-Basics_508c_1Feb2024.pdf CISA defines these roles as: Incident Manager is the response lead; Tech Manager is the subject matter expert; Communications Manager role is designed to address the press, public (usually via socials) and internal stakeholders.}