Request a proposal
Free Assessment
Cyber Risk Management
Risk Assessments
Security Posture AssessmentFreeCyber Risk Scoring GuideFreeCyber Risk Scorecard + Mitigation Plan$997Security Risk Assessment$997
Technology & AI Risk
Emerging Tech Risk RadarFreeShadow AI Discovery ChecklistFreeAI Acceptable Use Policy Pack$300Emerging Technology Risk Playbook$300AI Attack Surface Report$300Technology Risk Monitoring Retainer$300/moTechnology Risk Management Assessment$497Enterprise Security Modernization Roadmap$4,997
Vulnerability Management
Free Dark Web Scan + Security AuditFreeVulnerability Scan Report$300
Cyber Security Solutions
Threat Intelligence
Free Training: Attacker Threat BriefingFreeDefender Circle$300/mo · $397/yrMulti-Modal Threat Intelligence Program$3,500/mo
Email Security
Phishing and Social Engineering Audit$1,000
Cloud & Data Security
Data Security Governance Starter FrameworkFreeRealtime Adaptive Decisioning$12,500
Cyber Security Operations
Managed Detection & Response
AI-MDR Essentials$597/moAI-MDR Complete$1,197/moAI-Powered MDR Security Plans$397–$2,497/mo
Incident Response
Ransomware Response PlaybookFreeRansomware Readiness ChecklistFreeTier 3 Managed Retainer$6,500/moRansomware Containment Readiness$2,997
AI Threat Detection
AI Threat Exposure AssessmentFreeAI Traffic Anomaly Report$300
Cyber Security Defenses
Endpoint Security
Endpoint Security Scorecard$300Endpoint Security Servicesfrom $497Managed Endpoint Security Plans$300–$797/mo
Application Security
Application Security Pack$300AI Red Team Prompt Injection Kit$300
Network & Infrastructure Security
IoT Attack Surface Report$300Application Dependency Mapping$2,497Microsegmentation Design & Rollout$6,997
Compliance Services
HIPAA Compliance
HIPAA Risk Assessment WorksheetFreeHIPAA Compliance Package$12,500
Compliance Readiness
Compliance Readiness Assessment$997Security Compliance Suite$2,497/moFractional CISO Program$3,500/mo
Vendor & Third-Party Risk
Trust Center Care Plan$300/moCybersecurity Trust Center Build$4,997
HomeAboutBlogContactRequest a proposal

When something stops working, such as a system being unavailable or a building that cannot be entered, two things help straight away: knowing who to call, and writing down what is decided. A contact sheet and a decision log cover both. They are simple documents, and they are most useful when they were prepared before they were needed.

This article is general information about documentation and planning. It is not legal, compliance or security advice. Recovery targets and technical configuration are decisions for your organization to make with qualified professionals and to record in your own documents, and which obligations apply to you varies by organization, industry and jurisdiction. When and whom to notify outside the organization is a question for legal counsel and is not covered here.

The contact sheet

The contact sheet lists the people who may need to be reached when normal work is interrupted. List roles first and names second, so the sheet stays useful when people move on.

RolePrimary contactAlternateHow to reach them
Decision lead
Process owners
Systems contact
Facilities contact
Outside advisors

Keep a printed copy as well as a digital one, because the reason you need the sheet may be that a system is unavailable.

The decision log

The decision log is a running record kept while the disruption lasts. Each entry is short:

  • Time. When the decision was made.
  • Decision. What was decided, in one plain sentence.
  • Decided by. Who made the decision.
  • What was known. The information available at the time.
  • Next check. When the decision will be looked at again.

The log is not a place for blame or speculation. It records what was known and what was decided, so that later the organization can understand why things happened as they did.

Who keeps the log

Name a log keeper in advance, with an alternate. The log keeper’s only job is to write entries as decisions are made, which frees the decision lead to lead.

After the disruption

  1. Close the log with a final entry noting when normal work resumed.
  2. Hold a short review with the people on the contact sheet who were involved.
  3. Record what to change, such as a missing contact, an outdated number or a step that was unclear, with an owner for each item.
  4. Update the documents and keep the old versions.

Keeping both current

Review the contact sheet on a cadence your organization chooses and writes down, and whenever someone on it changes role or leaves. Record each review with its date and what changed.

For worksheets and checklists you can start from, see the Free Resources page on this site.

Editorial & AI Disclosure