Security

Business continuity: what to do on day one of a major incident

The first day of a major incident needs roles, communication, prioritization, evidence, and recovery. Improvisation increases damage.

July 22, 2026|6 min read

Day one decides the size of the damage

A major incident does not wait for an organized meeting. A system goes down, data disappears, a supplier stops, an attack advances, or physical operations stall. The company needs to decide quickly without destroying evidence, communicating poorly, or recovering the wrong service first.

A good continuity plan describes day one in plain language: who calls whom, which system comes first, which evidence must be preserved, and how customers will be informed.

The risk of being almost prepared

Data gathered by Secureframe from the 2025 State of Resilience indicates that 93% of leaders are concerned about financial and organizational impacts of outages, and 95% are aware of operational weaknesses that leave them vulnerable. Knowing the risk is not the same as being ready.

The gap usually appears in tests. Backup exists but was not restored. Contact lists exist but are outdated. A plan exists but no one trained.

The first-hours script

First, declare the incident and name a commander. Second, isolate the problem without erasing evidence. Third, prioritize services by impact. Fourth, communicate internally on a cadence. Fifth, prepare honest external messaging. Sixth, record decisions and time.

Then come recovery, probable cause, correction, and post-incident review. Skipping records now becomes expensive later.

Test before the crisis

Run a quarterly simulation with a realistic scenario: ransomware, link outage, database loss, supplier failure, or building unavailability. The goal is not to get everything right. It is to discover where the plan lies.