Build an Offline Cyber-Incident Contact Sheet Before Email Goes Down

The contact list must survive the incident it is meant to support

A cyber incident can disable email, shared files, cloud identity, phone systems, customer records, and normal help-desk tools at the same time. If the response plan and every phone number are stored only in those systems, the organization loses time when it matters most.

CISA’s incident-management guidance calls for primary and backup contacts, alternate communication methods, protocols for reaching backups, and defined communication responsibilities. The FTC recommends mobilizing a breach-response team, consulting legal counsel and forensic specialists, preserving evidence, coordinating communications, and determining notification duties. The FBI encourages victims of cyber-enabled crime to report quickly through appropriate channels because rapid reporting may support investigation and, in financial-fraud cases, recovery efforts.

An offline emergency contact sheet is not the incident-response plan. It is a compact bridge to the plan: a controlled, verified record that helps authorized people assemble the right team when ordinary systems are unavailable or untrusted.

For Central Florida organizations, the sheet should also work during hurricane-related power, cellular, transportation, and facility disruptions. Keep it short enough to use, detailed enough to remove ambiguity, and protected from unauthorized access.

What the sheet should contain

Use roles first and names second. People change; the response structure should remain. Every primary contact needs a backup. Include the date last verified and the person responsible for maintaining the record.

1. Incident coordinator

Record:

• Primary and alternate coordinator.
• Business mobile number and an approved alternate number.
• Personal or alternate email only if policy and security review permit its use.
• Decision authority and spending limit.
• Secure meeting or conference method.
• Escalation time if the primary does not respond.

The coordinator initiates the call tree, maintains an incident timeline, confirms roles, and prevents uncoordinated actions. This person should not be expected to perform every technical task.

2. Executive decision maker

Record the leader authorized to approve major containment, business shutdown, emergency spending, external communications, and recovery priorities. Add a successor if that person is unavailable.

Avoid a plan that requires approval from one executive who may be traveling, unreachable, or personally locked out of corporate systems.

3. IT and security responders

Include:

• Internal IT lead and alternate.
• Managed service or managed security provider’s emergency line.
• Incident-response or digital-forensics retainer contact.
• Identity, network, endpoint, cloud, backup, website, and telecommunications escalation paths.
• Contract or customer number required to receive help.
• Service hours, after-hours procedure, and response target.

Do not print administrator passwords, recovery keys, API secrets, or multifactor backup codes on the contact sheet. Store credentials through a separate approved emergency-access method.

4. Legal and privacy counsel

Record counsel with experience appropriate to the organization’s data, contracts, and sector. Include an after-hours procedure and who may engage outside counsel. Counsel can help preserve privilege where applicable, coordinate forensics, interpret obligations, and guide communications.

The sheet should not attempt to summarize all laws or deadlines. It should identify the qualified person who will verify current requirements based on facts.

5. Cyber-insurance contacts

Record:

• Carrier claims hotline.
• Policy number and policy period.
• Broker and alternate.
• Required notice method.
• Preapproved breach counsel, forensics, notification, restoration, and negotiation providers, if applicable.
• Actions that require carrier authorization.

Keep a protected offline copy of relevant policy pages or instructions. Do not hire an expensive responder or make a ransom-related commitment before understanding policy requirements and appropriate legal guidance.

6. Banking and payment contacts

For wire fraud, payment redirection, payroll fraud, or account takeover, minutes can matter. Record:

• Bank fraud department and relationship manager.
• Merchant acquirer and payment processor.
• Payroll provider.
• Authority to freeze, recall, or hold transactions.
• Known-good account and case reference information.

Verify these numbers directly through official statements, contracts, or provider websites—not a suspicious email, search advertisement, or message from the attacker.

7. Critical technology and business vendors

Prioritize vendors whose failure stops operations or whose access could expand the incident:

• Microsoft 365 or other cloud platform.
• Backup and disaster recovery.
• Internet, cellular, and telephone.
• Website, domain registrar, and DNS.
• Line-of-business applications.
• Payment, accounting, payroll, HR, and customer systems.
• Physical access, cameras, alarms, building controls, and specialized operational technology.

Record the security or emergency path, not only the salesperson or general help desk. Include tenant, site, subscription, or support identifiers that are safe to store on the sheet.

8. Law enforcement and government reporting

Record trusted paths rather than relying on a web search during the incident:

• Local emergency services for immediate threats to life or safety.
• Local police nonemergency number.
• Local FBI field office.
• FBI Internet Crime Complaint Center at **https://www.ic3.gov/** for internet-enabled crime and fraud.
• CISA reporting or assistance channels applicable at the time of the event.
• Sector regulator or government contact identified by counsel.
• Florida Attorney General or other state contact when applicable.

The FBI warns that criminals may impersonate IC3 and other authorities. Use exact, preverified official addresses. Do not pay fees, move money, or disclose credentials to someone who contacts the company claiming to recover funds.

9. Communications and customer support

Record:

• Authorized spokesperson and backup.
• Employee-communication lead.
• Customer-support lead.
• Public relations or crisis-communications advisor.
• Approved alternate website or status-page procedure.
• Known-good press, customer, partner, and employee distribution mechanisms.

The FTC recommends a comprehensive communications plan and a designated point person. Communications must be accurate, coordinated with counsel and law enforcement where appropriate, and careful not to expose additional sensitive information or impede an investigation.

10. Facilities, safety, and continuity

Include:

• Facility manager and landlord or property management.
• Alarm, access-control, generator, electrical, and fire/life-safety contacts.
• Alternate worksite and building-access authority.
• Emergency equipment vendor.
• Hurricane and severe-weather continuity coordinator.

Cyber containment can affect doors, cameras, phones, building systems, and remote access. Technical teams should not disable safety-related or operational systems without qualified coordination.

Copyable one-page template

Use the following structure and adapt it to the organization. Keep operational details on the response plan; keep the contact sheet focused.

Document control

• Organization and site: ______________________________
• Version/date: ______________________________________
• Verified by: _______________________________________
• Next verification date: _____________________________
• Controlled copy number/location: ____________________
• If found, return to: ________________________________

Activation

• Incident coordinator: _______________________________
• Mobile/alternate: __________________________________
• Backup coordinator: _________________________________
• Mobile/alternate: __________________________________
• Escalate to backup after: ___________________________
• Secure meeting method: ______________________________
• Incident time source/time zone: _____________________

Decision and advice

• Executive authority/backup: _________________________
• Legal counsel/after-hours: __________________________
• Privacy or compliance lead: _________________________
• Cyber insurer/broker/policy: ________________________
• Finance authority/backup: ___________________________

Technical response

• Internal IT/backup: _________________________________
• MSP/MSSP emergency: ________________________________
• Forensics/incident response: ________________________
• Identity/cloud escalation: __________________________
• Network/internet/phone: _____________________________
• Backup/recovery: ___________________________________
• Website/domain/DNS: _________________________________
• Critical application: _______________________________

Financial response

• Bank fraud department: ______________________________
• Merchant/payment provider: __________________________
• Payroll provider: ___________________________________
• Transaction-freeze authority: _______________________

Reporting and communication

• Local emergency/police: _____________________________
• Local FBI field office: _____________________________
• IC3 official site: https://www.ic3.gov/
• CISA/sector contact: _________________________________
• State/regulatory contact: ___________________________
• Employee communications: ___________________________
• Customer communications: ___________________________
• Authorized spokesperson: ____________________________

Continuity

• Facility/property contact: __________________________
• Alarm/access control: _______________________________
• Generator/electrical: _______________________________
• Alternate worksite: _________________________________
• Hurricane continuity lead: __________________________

First-call reminders

• Preserve evidence and start an incident timeline.
• Use known-good devices and verified contact methods.
• Do not power off affected equipment unless the response plan or qualified responder directs it.
• Do not publicly speculate or promise a notification outcome.
• Do not pay, transfer money, or follow attacker instructions without authorized legal, financial, insurance, and law-enforcement coordination.

Add decision rules, not just phone numbers

A list without activation rules can still produce delay. Define:

• Who can declare a security incident.
• Which events trigger after-hours escalation.
• How long to wait before calling a backup.
• Who may isolate systems, disable accounts, stop payments, or engage responders.
• Who approves emergency spending.
• Who communicates with employees, customers, partners, media, and authorities.
• Where the response team meets if corporate collaboration tools are unavailable.
• Which channel is considered trusted for instructions.

For example:

> If the primary coordinator does not acknowledge within 10 minutes for a suspected active intrusion, call the backup coordinator and executive authority using the verified numbers on this sheet. Do not send sensitive incident details by ordinary text message.

The appropriate time depends on business impact. Write the rule before the incident.

Establish alternate communications

Corporate email, Microsoft Teams, a cloud phone system, and the help desk may depend on the same identity or network. An alternate channel must not share the same single point of failure. Options may include:

• A prearranged secure conference line or emergency collaboration tenant.
• Dedicated emergency phones or verified mobile numbers.
• An external status page controlled through separate protected access.
• A physical meeting location and paper call tree.
• A secure communications service approved and tested in advance.

Do not improvise by moving sensitive logs, customer data, or credentials into personal email or consumer messaging. Define what information each alternate channel may carry.

Central Florida organizations should test communications during a local power or cellular outage scenario. Confirm which mobile carriers, internet providers, and facilities share dependencies.

Protect the contact sheet itself

The sheet contains names, direct numbers, vendors, policy identifiers, and response relationships that could help an attacker impersonate trusted parties. Protect it:

• Mark and handle it according to the organization’s information policy.
• Number controlled paper copies and record custodians.
• Store copies in physically secure, accessible locations.
• Use an encrypted offline digital copy where appropriate.
• Do not place passwords, recovery keys, security answers, or sensitive architecture on it.
• Retrieve outdated paper copies and destroy them securely.
• Limit distribution to people who need the information.

Balance protection with availability. A copy locked in an inaccessible office is useless during evacuation or after-hours response.

Verify every number quarterly

A contact sheet degrades quickly. Each quarter:

• [ ] Call or otherwise validate primary and backup internal contacts.
• [ ] Confirm provider emergency numbers and support entitlements.
• [ ] Verify insurance policy, claim process, and approved responder lists.
• [ ] Verify bank and payment fraud contacts from official records.
• [ ] Confirm official government web addresses and local field-office contacts.
• [ ] Test alternate communications without sending sensitive data.
• [ ] Confirm custodians possess current controlled copies.
• [ ] Replace and securely destroy superseded copies.
• [ ] Record verification date, tester, failures, and corrective actions.

Do not assume the number printed on a three-year-old insurance card reaches an incident hotline. Test the process, not only the typography.

Run a 20-minute call-tree exercise

Use a safe scenario such as:

> At 7:15 a.m., the finance manager reports that Microsoft 365 sign-ins are failing and several computers display a ransom note. Corporate email and Teams are considered untrusted. No safety incident is known.

Then test:

1. Can the discoverer reach the coordinator using a trusted channel?

2. Does the coordinator reach the backup, executive, IT, legal, insurer, and responder in the intended order?

3. Can participants join the alternate meeting method?

4. Do they know who may isolate devices and stop payments?

5. Can someone locate the insurance, vendor, bank, FBI, and continuity contacts?

6. Is an incident timeline started using a trustworthy time source?

7. Are missing numbers and unclear authority assigned for correction?

Do not actually disable production systems or contact external authorities during a tabletop unless the exercise is coordinated and clearly identified.

Know when to report

Reporting decisions depend on the event, data, sector, contracts, law, and advice from authorized counsel and responders. The sheet should route the decision, not predetermine it.

The FBI advises victims of internet-enabled crime or fraud to file with IC3 as soon as possible and to contact a local field office for relevant cyber incidents. For ransomware, the FBI directs victims to the local field office or IC3. The FTC advises businesses to determine applicable notification requirements, involve law enforcement, and notify affected businesses and individuals as appropriate. Florida’s Attorney General provides resources noting that Florida businesses have notification duties when personal information is exposed.

Do not infer that every alert is a reportable breach. Do not delay qualified assessment because no one knows whom to call.

Five mistakes the sheet prevents

Searching the internet for a hotline during a fraud

Search advertisements and lookalike sites can lead to impostors. Use preverified official numbers and addresses.

Calling only the general help desk

A provider’s emergency security route may differ from ordinary support. Record both and the contract identifier.

Discovering insurance restrictions after hiring responders

Record claim instructions and approved-provider requirements before an event.

Letting several people issue conflicting instructions

Name the coordinator, decision authority, spokesperson, and backups.

Storing the plan only in the compromised environment

Keep protected offline copies and test that authorized people can retrieve them.

Final review checklist

Before approving the sheet, confirm:

• [ ] Every role has a named primary and backup.
• [ ] Every number and URL came from a trusted official source.
• [ ] Escalation times and decision authority are explicit.
• [ ] Alternate communications do not share the same single point of failure.
• [ ] No passwords, recovery keys, or sensitive personal data appear on the sheet.
• [ ] Insurance, bank, vendor, legal, responder, government, and continuity contacts are included.
• [ ] Copies are controlled, available, and protected.
• [ ] The call tree has been tested.
• [ ] A quarterly owner and next review date are assigned.

The best contact sheet is the one the team can find, trust, and use under pressure. One printed page cannot resolve an incident, but it can help the organization reach the people who can.

Human-reviewed draft. This article and template provide general information, not legal, regulatory, insurance, forensic, reporting, or incident-response advice. Verify all contact details from official sources and tailor decisions to the organization’s current obligations and circumstances.