Incident Response Coordinator
Keeps your first-hour plan and contacts current all year; in an incident, coordinates IT, lawyer, insurer and bank.
A digital employee that keeps your first-hour incident plan and contact list current. If something goes wrong, it helps preserve evidence, coordinates your IT provider, lawyer, insurer and bank, and tracks the notification deadlines your lawyer sets. Important steps wait for a person.
What they do day-to-day
- Keeps the first-hour plan up to date and easy to find.
- Keeps the contact list current: IT provider, lawyer, insurer, bank.
- Checks once a quarter that every contact on the list still works.
- In an incident, follows the plan with your manager and keeps a timed log of every step.
- Helps preserve evidence (screenshots, logs, emails) before anything is cleaned up.
- Tracks the notification deadlines your lawyer sets and reminds the owners of each one.
- Writes the after-incident summary for your review.
Common situations they handle
- You don't know who to call first if your email or site is hacked.
- Your insurer requires notice within a set time and you'd miss it.
- Evidence gets wiped in the rush to fix things.
Best for
- Businesses with cyber insurance.
- Firms holding client or customer data.
- Owners who want a calm, written plan before they need it.
Channels they operate on
- Document creation: the plan, contact list, log and summary.
- Email or chat: coordination with your team and outside contacts you approve.
- Calendar and reminders: deadlines your lawyer sets.
- Knowledge base: insurance policy, contracts and contacts.
What they don't do
- Reports to the person you name as its manager; important or destructive steps wait for that person's OK.
- Doesn't give legal advice or decide which notice laws apply; it tracks the deadlines your lawyer sets.
- Doesn't contact regulators, customers, the press or attackers; your designated person handles those communications.
- Doesn't pay ransoms or move money.
- Doesn't investigate the incident technically; your IT provider does.
- Keeps incident readiness current all year. A one-time runbook draft comes with the Security Hygiene Specialist's check-up.
- Important or irreversible steps wait for a person.
Sample interactions
First hour of a suspected email takeover
Digital employee to Owner (chat): «First-hour plan started at 09:12. Done: screenshots of the forwarding rule saved, IT provider called in and joining at 09:30. Waiting on you: OK to call the insurer's incident line (policy number in the plan), and to brief your lawyer, who sets any notice deadlines. Timed log attached.»
Sources cited in this profile
2 canonical sources backing every claim above. Visible to internal review on request.