Operating Cadence
Part of Startup risk and access controls
Preparing an incident contact list before a disruption
Build an incident contact list with first responders, alternates, contact triggers and an accessible fallback copy.
An incident contact list tells whoever first notices a problem whom to reach, through which channel, and who takes over if that contact is unavailable. Prepare it before an outage or security event. Keep a protected copy reachable when normal systems fail, and confirm the details with the people expected to respond.
Start with the first report
Name the person who receives a report, and a backup. Give a way to reach them outside the usual work channel. Tell the reporter what to pass on: what happened, when it was noticed, what is affected and whether anyone is in immediate danger. Where people are at risk, follow applicable emergency and safety arrangements first.
Then group contacts by the help or decision they provide:
| Contact role | When needed | Detail to check |
|---|---|---|
| Incident lead and alternate | Coordinate the first response | Availability and backup channel |
| System or service owner | Assess an affected account or operation | Which service they own |
| IT or security support | Investigate a suspected cyber issue | Route available if email is down |
| Bank contact | Respond to suspected payment fraud | Official contact route |
| Customer communications owner | Prepare an accurate update | Who may approve the message |
Add emergency services, an insurer, legal adviser, landlord or specialist supplier only where relevant to the business. The list should point to the right procedure. Do not include account credentials or a complete incident plan.
Contact types and their responsibilities in an incident
- Incident lead and alternate
- Coordinate initial response; must be reachable via backup channel
- System or service owner
- Assess impact on specific systems or services they manage
- IT or security support
- Investigate suspected cyber threats; use non-email routes if needed
- Bank contact
- Respond to suspected payment fraud via official emergency channel
- Customer communications owner
- Prepare accurate messages; confirm approval process with responsible person
Make the list reachable
A copy held only on a shared drive may be unavailable during a network or account outage. Choose a controlled offline or hard-copy route for the people who need it. Limit copies, include personal numbers only where appropriate, and arrange to replace or dispose of outdated copies.
Do not assume work email and the usual chat application will both function. Agree an alternative method for important contacts. Record availability limits rather than implying that a person or supplier will answer at any hour. Confirm an external provider's emergency route and its terms before adding it.
Key facts about incident contact lists
- Offline access required
- A copy must be accessible when email and shared drives fail
- No credentials allowed
- Never include account passwords or full incident plans
- External provider checks needed
- Confirm emergency routes and terms before adding third-party contacts
Give each contact a purpose
Beside each contact, state the trigger, who may call, what help or decision is needed and which reference details can safely be shared. Suspected payment fraud may require prompt contact with the bank through its official channel.
A cyber incident may require technical help and an operational decision about affected services. Reporting or notification duties depend on the event and the business; route those questions to the responsible person.
Keep it current
Ask the nominated responder to find the list through its fallback route and explain the first calls for a simple scenario. Confirm key numbers and responsibilities with their owners. Assign someone to update the list after staff, provider or location changes and to replace superseded copies.
