Know who makes the call
Identify who can assess an issue, authorise containment, and coordinate business decisions. Include alternatives when the primary contact is unavailable. Keep relevant contact information accessible if a normal business system becomes unavailable. Review ownership when people or suppliers change.
Prepare the first report
Record what was observed, when it began, which systems may be involved, and what impact is visible. Separate confirmed facts from assumptions. Maintain a timeline of actions, decisions, and authorisations. Do not include secrets, suspicious executables, or full datasets in an unsolicited email.
Exercise the decisions
A discussion-based exercise can walk through a scenario without touching production systems. Consider who notices an issue, what information is missing, how decisions are recorded, and who communicates. Agree objectives and participants in advance. Turn lessons into specific actions with owners.
If you suspect an incident now
Follow your internal incident process and involve the responsible team. General website guidance is not a substitute for instructions tailored to your environment. EchoBastion provides an email contact route, not a continuously monitored emergency service. No immediate response or support availability is guaranteed.