Write a one-page incident response plan (before you need it)

You won’t write a perfect IR playbook at seed stage. You can write one page that prevents freeze-up.

Include these sections

1. Severity cheat sheet: lost laptop vs active ransomware vs email takeover
2. First actions: who freezes accounts, who talks to customers
3. Contact tree: cofounder, IT helper, lawyer, hosting, bank
4. Evidence: don’t wipe machines immediately if investigation matters
5. Comms draft: a calm template for customers if data may be involved

Practice once

Tabletop a simple scenario: “Our Google admin was phished.” Walk through the steps. Update the page where you got stuck.