Cyber Incident Response Planner
A one-page plan for the morning your email, your files or your payments are compromised, with who calls whom in the first hour, what the privacy law requires you to report, and the three fixes that make the plan rarely needed
The problem
At 7:10 on a Tuesday your bookkeeper can't open the shared drive and there's a text file on the desktop with a payment address in it. Or a customer calls to say they got an invoice from you with someone else's banking details. Or your Instagram is posting crypto ads. In that hour, a small business with a plan makes four phone calls in the right order. A small business without one spends the morning googling, pays a ransom it didn't need to pay, and finds out three weeks later that the breach had to be reported to the Privacy Commissioner. The plan is one page. Writing it before Tuesday is the whole trick. This skill writes it from how your business runs.
The tool
Once installed, this skill interviews you about what you'd lose: which systems hold customer data, who has admin access, where the backups are and when anyone last restored one, which bank and insurer you'd call, and who in the business is in charge when you're on a plane. Then it writes the one-page plan: the first-hour checklist (disconnect, don't wipe, call the bank if money is involved, call the IT person or provider, start a log), the contact card with the numbers filled in, and the decision points (when to call the police, when to call a lawyer, what to say to customers and when).
It covers the reporting duties in plain language: under PIPEDA, a breach of security safeguards that creates a real risk of significant harm has to be reported to the Office of the Privacy Commissioner and to the affected people, and a record kept of every breach, whatever its size; Quebec's Law 25 adds the Commission d'accès à l'information for anyone holding Quebec residents' data; Alberta has its own rule. The skill tells you which apply to you and drafts the customer notice so you're not writing it in a panic. And it closes with the three fixes that prevent most of this: multi-factor authentication on email and banking, offline backups tested quarterly, and the payment call-back rule from the Payment Fraud Screener.
What's inside
- A first-hour checklist for the four common incidents: ransomware, email takeover, invoice fraud, social account hijack
- A contact card: bank, insurer, IT provider, lawyer, the police non-emergency line, the Canadian Anti-Fraud Centre, with the numbers you fill in
- A reporting guide: which privacy law applies to your business, what triggers a report, who gets notified, and the breach record you keep regardless
- A customer notice and a staff note, drafted in advance and kept in a drawer
- An incident log template, because the insurer and the lawyer will both ask for one
- The three preventive fixes, ranked, with a Saturday-morning plan for doing them
How to use it
- 1Click "Install skill" on this page and copy the install prompt.
- 2Paste it into your AI assistant (ChatGPT, Claude, anything that accepts pasted text).
- 3Answer the interview: your systems, your data, your backups, your access, your insurer, your IT help.
- 4Print the one-page plan and the contact card, fill in the numbers by hand, and put a copy where the plan can be found without a computer.
- 5Do the three fixes it ranks, then re-read the plan every six months or after any change in staff or systems.
Example
A dental lab in Mississauga with eleven staff runs the interview and discovers three things in twenty minutes: the only person with admin access to email is on vacation half of July, the backups go to a drive that sits plugged into the server (so ransomware would take them too), and nobody knows whether the business insurance policy covers cyber incidents. The plan that comes out names the office manager as the second admin, moves backups to a rotated offline drive tested on the first Monday of each month, and puts "ask the broker about cyber coverage" at the top of the fixes. The customer notice is drafted and filed. Eight months later a phishing email gets a password; the first-hour checklist is followed, the account is locked in twenty minutes, nothing is reported because nothing left, and the log shows what happened.
Pro tip
Test the backup by restoring one file this week. A backup nobody has restored from is a hope, not a backup, and ransomware operators know which drive is plugged in. And put a paper copy of the contact card in the cash drawer or the first-aid kit, because the morning you need it, the computer with the plan on it is the one that's locked.
Related tools
Want this customized and automated for your business?
We take the tools in this toolbox and wire them into your business: your data, your brand voice, running on autopilot.
Talk to Vexlo