During a serious outage or ransomware attack, people make decisions quickly and under stress. Who is in charge? Which system comes back first? Where are the passwords? Who talks to the insurer? If those answers exist only in someone's head, or on a server that is down, the company loses precious time. A one-page runbook gives everyone a shared starting point.
The goal is not a hundred-page disaster recovery plan that no one reads. The goal is one page you can print and keep in a binder, a fireproof box and a few trusted phones.
What belongs on the page
1. Who is in charge
Name an incident lead and a backup, with mobile numbers. List the people who must be reached: owner or president, finance lead, operations lead, IT provider and legal counsel. State who may authorize emergency spending and who may speak to customers, the press and employees.
2. When to activate
Describe what triggers the runbook. Examples: ransom note or encrypted files, loss of the main server, email unavailable for more than a few hours or suspected compromise of finance accounts. When in doubt, activate. A false alarm costs little.
3. First actions
A short list of first moves, in order.
- Stop and notify the incident lead and IT provider.
- Disconnect affected devices from the network, but do not power them off unless instructed, since memory contains evidence.
- Do not delete files, wipe machines or pay anything before consulting the response team.
- Preserve evidence, such as ransom notes and screenshots.
- Call the cyber insurance carrier's incident line, if you have coverage.
- Switch to out-of-band communication if email may be compromised.
4. Recovery priorities
List your critical systems in the order they should return, with a target recovery time for each. For example, a hypothetical contractor might rank them as follows.
- Identity and email, so people can communicate and sign in safely
- Payroll and accounting
- Project management and document access
- Estimating and bid files
- Remaining file shares and applications
Your order will differ. Decide it now with input from finance and operations, not during the crisis.
5. Where the backups are
For each system, note where backups live, who can access them, how to restore and how long a restore takes based on your last test. Note which copies are offline or protected from deletion.
6. Where the credentials and keys are
Record where to find administrator credentials, encryption keys, licensing information and vendor account details, in a location that does not depend on the systems being down. An offline binder or a sealed envelope held by a trusted party are common choices. Limit who can open it, and log each use.
7. Key contacts
Keep a printed list including:
- IT provider and the best after-hours number
- Cyber insurance carrier and policy number
- Legal counsel
- Bank fraud and treasury contacts
- Key software vendors and their support lines
- Internet and phone providers
- Prime contractor or customer security contacts, if reporting duties apply
- Law enforcement contacts, including the FBI's local office or the IC3 reporting site
8. Communication notes
Decide how employees will be told what is happening and how to reach each other if email and chat are unavailable, such as a text group or phone tree. Include short drafts for messages to employees and customers that counsel can approve quickly.
9. Manual workarounds
Note how payroll, time capture, purchasing and project communications could run temporarily on paper or alternative tools. Field crews still need to work, so think through how they will receive plans and report time.
Keep it alive
A runbook goes stale quickly. Assign an owner to review it every quarter and after major changes such as new systems, staff changes or provider changes. Update contact numbers and recovery times based on your restore tests.
Practice
Run a one-hour tabletop exercise with the people named on the page. Give them a scenario, like ransomware on the main file server on a Monday morning, and walk through the steps. Note where the page was unclear or missing something, and fix it.
Print it
Distribute copies in physical and secure digital form. Include a copy at the owner's home or in a safe location, not only in the office. If the office network is down, the page must still be reachable.
A starting template
Use these headings: Lead and backup, Activation triggers, First actions, Recovery order, Backup locations, Credentials location, Contacts, Communications, Manual workarounds, Review date.
How we help
Ironfield Cyber helps contractors and energy companies draft recovery runbooks, test them and build the backups that make them work. If you would like to start with a template and a working session, we are happy to help.