Incidents are shaped before the formal incident team exists.
The person who discovers the problem calls someone they trust. That person adds an expert. An executive calls a friend at the provider. Someone informs the principal with an incomplete story. Within twenty minutes, facts have been repeated, instructions conflict and the provider has received three versions of authority.
Call sequence is a control
For a private office, the first five roles usually need to cover: incident command, technical containment, legal/privacy judgement, operational continuity and principal authority. The names vary. The functions should not.
The order matters. Incident command must form before a broad executive audience. Technical containment needs permission to act. Counsel needs preserved facts, not rumours. Operations needs to protect essential services. The principal needs a decision-ready brief, not live diagnostic noise.
The five-call card
- Caller one: incident lead—opens the event log and assigns the first containment action.
- Caller two: technical lead—preserves evidence and stops active consequence.
- Caller three: counsel/privacy lead—sets privilege, notification and preservation boundaries.
- Caller four: continuity owner—keeps critical payments, travel, safety and communications functioning.
- Caller five: principal authority—receives impact, actions, decisions required and next update time.
Providers, insurers and specialist responders may enter immediately after, but through one accountable lead.
Field test
Give a staff member a scenario—lost principal phone, fraudulent transfer, exposed family document—and ask them to make the first five calls without opening a policy. If they cannot, the plan is stored information, not operational memory.
The first five calls determine whether the organisation builds a control room or a rumour network.