Identify the core response team consisting of your executive sponsor, IT lead, security officer, and communications lead.

For regulated industries, include compliance or legal representatives who can advise on breach notification timelines.

Share the updated contact sheet with NTS so our incident response engineers can coordinate without delays.

Use an out-of-band collaboration tool such as Microsoft Teams crisis channel or Signal for executives when email integrity is uncertain.

Define what information is appropriate for chat, ticketing systems, and phone calls to maintain a clear audit trail.

Prepare executive-ready templates for internal memos, customer notifications, and vendor updates.

Capture a detailed incident timeline including detection method, affected systems, containment steps, and remediation actions.

Collect logs and forensic artifacts in a secure folder that is access-controlled but available to the investigation team.

Schedule a lessons-learned session within 10 business days to prioritize follow-up tasks and update response runbooks.