Incident response plans
A short, usable plan: who to call, what to shut off and how to communicate, tested before you need it.
Readiness rehearses it.
Response plans, tabletop exercises and recovery testing that prepare your team for the day something goes wrong, so decisions take minutes instead of days.
Five moments. One morning. Would your team catch it?
A typical email fraud incident at a small nonprofit. Select each moment to see what a rehearsed team does.
08:52 Email
A convincing phishing page
Phishing pages copy real sign in screens, logo and all. Nothing looks wrong to the person typing.
What a rehearsed team does
Multifactor authentication is on for every account, and staff know to report a suspicious page right away, even after they have clicked.
09:10 Microsoft 365
An alert nobody owns
Microsoft 365 and Google Workspace can flag unusual sign ins, but an alert only helps if someone is assigned to act on it.
What a rehearsed team does
One named person reviews sign in alerts, and the plan says exactly how to reset the password and end every active session.
09:24 Mailbox
The attacker hides
Before asking for money, attackers quietly watch and hide their tracks so replies never reach the real owner.
What a rehearsed team does
Checking for new forwarding and inbox rules is a standard step whenever an account is suspected.
10:15 Finance
The ask
Because the request comes from a known account, it looks legitimate and gets processed like any other.
What a rehearsed team does
Any change to banking details is verified by calling a number already on file, never one from the email.
11:30 Donors
Now it is public
The incident has reached your supporters, and your reputation is part of the response.
What a rehearsed team does
A communication plan is ready: who contacts donors, what they say and when the board is told.
Each moment is a decision. A tabletop exercise lets your team make those decisions in a conference room first, not during the real thing.
What Readiness covers.
Practical preparation for the incidents that actually reach small organizations.
Tabletop exercises
Guided scenarios where leadership and staff practice real decisions, followed by a written after action report.
Microsoft 365 and Google Workspace reviews
Configuration reviews for the accounts, sharing settings and email protections your organization depends on.
Backup and recovery testing
Proof that you can restore your files and systems, and a measured answer to how long it takes.
Payment fraud controls
Verification steps for bank changes, gift card requests and wire transfers that stop email payment fraud.
Vendor and provider oversight
Help choosing a managed IT or 24/7 monitoring provider and confirming they deliver what your plan requires.
How readiness comes together.
Review
Look at your accounts, backups, vendors and any plans you already have.
Plan
Write or update a response plan your team can follow under pressure.
Rehearse
Run a tabletop exercise built on the threats you actually face.
Improve
Close the gaps the exercise revealed and schedule the next one.
Start with a tabletop exercise.
A guided session with your leadership team, one realistic scenario and a written report on what to improve.
Request a consultationMeet the other programs.
The same team plans, rehearses and teaches, so nothing gets lost between a finding and the fix.
Advisory
Plan it.
Fractional security leadership for organizations without a security lead. We assess where you stand, set your AI use policy and build a roadmap your board can approve and your funders can trust.
- Security lead (vCISO)
- Risk assessments
- AI use policy
- HIPAA readiness
Training
Teach it.
Plain language security and AI training for staff, volunteers and boards, plus community programs that help seniors stay safe online and veterans move into technology careers.
- Staff and volunteers
- Safe AI use
- Board briefings
- Seniors and veterans