{"product_id":"first-hour-after-a-breach-kit","title":"First Hour After a Breach: Incident Response Plan Template, Runbook, Contact Sheet, Log and Tabletop Exercise (UK Small Business)","description":"\u003cp\u003e\u003cstrong\u003eFor UK small businesses, with or without an IT provider. When something goes wrong, people need to know who does what and who to call. This kit gives a small business an incident response plan for the first hour, worked out in advance.\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eIt covers four kinds of incident: an account taken over, ransomware or malware, a lost or stolen device, and invoice or payment fraud. Each one has its own decision steps. If personal data is involved, the runbook walks you through the ICO's 72-hour decision.\u003c\/p\u003e\n\u003cp\u003eIt's based on UK guidance from the NCSC, the ICO, Report Fraud (formerly Action Fraud), the Payment Systems Regulator and UK Finance's Take Five campaign. A sources list lets you check it yourself.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003e£29 · digital download (ZIP file).\u003c\/strong\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat's inside\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eStart here guide\u003c\/strong\u003e (PDF): how to set the kit up before you need it\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eFirst-hour runbook\u003c\/strong\u003e (PDF): five first moves for any incident, then decision steps for each incident type and for the 72-hour decision. It ends with a who-to-tell table and short scripts for staff, customers and suppliers\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eEmergency contact sheet\u003c\/strong\u003e (editable Word document): your incident roles and providers, with the UK reporting numbers filled in\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eIncident log and timeline workbook\u003c\/strong\u003e (Excel): a timeline of what happened and who decided what, and why. It works out the 72-hour point for you and keeps payment details and reference numbers together\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eTabletop exercise\u003c\/strong\u003e (PDF): three practice scenarios with a facilitator sheet and debrief page.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eHow it works\u003c\/h3\u003e\n\u003col\u003e\n  \u003cli\u003eClick Get My Kit and check out. You'll receive a download link after payment.\u003c\/li\u003e\n  \u003cli\u003eOpen the Start here guide and set the kit up before you need it, starting with the contact sheet.\u003c\/li\u003e\n  \u003cli\u003ePractise with your team using one of the tabletop scenarios.\u003c\/li\u003e\n  \u003cli\u003eIf something happens, follow the runbook and keep the incident log as you go.\u003c\/li\u003e\n\u003c\/ol\u003e\n\u003cp\u003eIt's self-serve. You set it up yourself, with no calls or meetings with us.\u003c\/p\u003e\n\u003ch3\u003eWhat it isn't\u003c\/h3\u003e\n\u003cp\u003eSecordit Intelligence isn't an incident-response provider, a bank, an insurer or a law firm. The kit can't recover money or data, or investigate an attack. Your bank decides about money. Report Fraud, or Police Scotland in Scotland, takes crime reports. The ICO takes personal data breach reports, and your insurer or broker answers questions about cover.\u003c\/p\u003e\n\u003cp\u003eGeneral information, not legal advice.\u003c\/p\u003e\n\u003ch3\u003eFAQ\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003eDo we have to report every breach to the ICO?\u003c\/strong\u003e\u003cbr\u003eNo. The ICO says: \"You do not need to report every breach to the ICO.\" You report where a risk to people is likely. Either way, you record every breach.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWill it help us get money back after invoice fraud?\u003c\/strong\u003e\u003cbr\u003eIt tells you to call your bank straight away, and explains the PSR's reimbursement protections for some bank transfers. They cover individuals, microenterprises and charities, so not every business qualifies. Whether any money comes back is your bank's decision.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWe have an IT provider. Is this still useful?\u003c\/strong\u003e\u003cbr\u003eYes. The runbook tells you when to call them, and covers the parts that are the business's job: the bank, reporting, the ICO decision, staff and customers.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat format are the files?\u003c\/strong\u003e\u003cbr\u003ePDF, Word (.docx) and Excel (.xlsx). The workbook has been tested in LibreOffice Calc. It should also open in Excel and Google Sheets.\u003c\/p\u003e\n\u003ch3\u003eWho's behind it\u003c\/h3\u003e\n\u003cp\u003eSecordit Intelligence was set up in February 2026 by Matthew Protheroe-Hill, its director. Before that, he co-founded Sencode Cyber Security and was a director there from 2019 to 2023. Qualification: BSc (Hons) Cyber Security \u0026amp; Networks (1st Class), Teesside University.\u003c\/p\u003e\n\u003ch3\u003eEverything in the download\u003c\/h3\u003e\n\u003cp\u003eA ZIP with 5 files: the Start here guide (PDF), the first-hour runbook (PDF), the emergency contact sheet (Word), the incident log and timeline workbook (Excel) and the tabletop exercise (PDF).\u003c\/p\u003e\n\u003ch3\u003eThe problem it helps with\u003c\/h3\u003e\n\u003cp\u003eWhen something goes wrong, people need to know who does what and who to call. This kit lets a small business work that out in advance, and practise it.\u003c\/p\u003e\n\u003ch3\u003eCompared with paying for help\u003c\/h3\u003e\n\u003cp\u003eYou'd rather have a plan in place before something goes wrong than work it out in the middle of it. A specialist firm or an IT consultant can write an incident response plan with you, and they charge for their time. This kit lets you set the plan up yourself and practise it. It's a set of templates, not a like-for-like swap for paid help.\u003c\/p\u003e\n\u003ch3\u003eDelivery\u003c\/h3\u003e\n\u003cp\u003eDigital download (ZIP file). You'll receive a download link after payment.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eReady to start? Use the Get My Kit button under the price at the top of this page.\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003csmall\u003eSecordit Intelligence's own product. Not made, checked or endorsed by the NCSC, the ICO, GOV.UK, Report Fraud, Police Scotland, the PSR, UK Finance or Take Five. Contains public sector information licensed under the Open Government Licence v3.0: https:\/\/www.nationalarchives.gov.uk\/doc\/open-government-licence\/version\/3\/\u003c\/small\u003e\u003c\/p\u003e","brand":"Secordit Intelligence","offers":[{"title":"Default Title","offer_id":58035580240252,"sku":null,"price":29.0,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0947\/1508\/5180\/files\/kit-v3gf2-first-hour-after-a-breach-kit-main-2048.png?v=1793310149","url":"https:\/\/secordit.co.uk\/products\/first-hour-after-a-breach-kit","provider":"Secordit Intelligence","version":"1.0","type":"link"}