Operations
Incident & Continuity Plan: what to do when the site goes down
The Incident & Continuity Plan is ten written plans for the days that go wrong, from a site outage to a data breach, plus kill switches and a continuity plan. From £299. Ready in 5 working days.
Why does a small business need an incident plan?
On a bad day the owner works it out live, under pressure and often alone, and the steps that matter get missed. Insurers and larger customers now ask to see a plan, and a generic template helps nobody when it happens.
On the day, the owner works it out live, under pressure, often alone. The steps that matter - what to switch off, who to tell, the legal deadline for a breach - get missed.
Insurers and larger customers increasingly ask to see a plan. A generic template answers the question on paper and helps nobody when it actually happens.
Is a downloaded incident plan template good enough?
A downloaded template names no real systems, so nobody can follow it. The Incident & Continuity Plan is 10 plans written for your systems, with breach steps and the ICO deadline, a tested rebuild checklist and a plan you can show an insurer.
| Working it out on the day | A downloaded template | Incident & Continuity Plan | |
|---|---|---|---|
| What exists | Nothing written | A generic document | 10 plans for your systems |
| Who can follow it | Only you, if you remember | Nobody - it names no real systems | Anyone you hand it to |
| A data breach | Guesswork on the deadline | A paragraph of general advice | Steps, the ICO deadline, who to tell |
| If your PC dies | Days of rebuilding | Not covered | A tested rebuild checklist |
| Insurers and buyers | No answer | A document, not a plan | A plan you can show |
What is in the Incident & Continuity Plan?
The Incident & Continuity Plan gives you a first-five-minutes triage page, 10 written plans, the features you can switch off without a developer, a breach plan, a continuity plan for your accounts and backups, and one plan run with you as a drill.
- 01
First five minutes
A one-page triage: how bad is it, who to wake, which noise to ignore.
- 02
10 written plans
Site down, site broken, payments, logins, database, email, a bad change, a data breach, a supplier outage, your PC dead.
- 03
Your systems named
Each plan uses your real hosts, logins and phone numbers, not placeholders.
- 04
Kill switches
A list of the features you can turn off fast without a developer, and exactly how.
- 05
A breach plan
What to contain, what to record and how to decide whether to report it to the ICO.
- 06
A continuity plan
Your accounts listed, what is backed up and what is not, and how to carry on if you are out of action.
- 07
A walk-through
We run one plan with you as a drill, so the first time you use it is not the real thing.
Which bad days does the plan cover?
The Incident & Continuity Plan has a triage page and one plan each for the site down, the site broken, payments, logins, the database, email, rolling back a change, a data breach, a supplier outage and your PC dead.
incident-plan/
- 0-first-five-minutes.md
- 1-site-completely-down.md
- 2-site-up-but-broken.md
- 3-payments-failing.md
- 4-nobody-can-log-in.md
- 5-database-trouble.md
- 6-emails-not-sending.md
- 7-rolling-back-a-change.md
- 8-data-breach.md
- 9-supplier-outage.md
- 10written incident plans
- 6quick-reference appendices
- 5 minfirst-response triage page
Source GigXchange's own figures, as of 25 October 2026
How long does it take to write an incident plan?
The Incident & Continuity Plan takes 5 working days. Days 1-2 list every account, supplier and system you stand on, days 3-4 write the plans around your setup, and day 5 walks one plan with you as a drill.
- 01
Days 1-2
Inventory
We list every account, supplier and system the business stands on, and what is backed up.
- 02
Days 3-4
Write
The triage page, 10 plans, kill switches and the continuity plan, written around your setup.
- 03
Day 5
Drill
We walk one plan with you end to end, fix what it misses and hand over the set.
Who is the Incident & Continuity Plan for?
The Incident & Continuity Plan suits a business that stops when the website or payments stop, has been asked for a plan by an insurer or big customer, or has one person who knows how things work. It is not a certified ISO 22301 programme.
A good fit if
- Your business stops if the website or payments stop
- An insurer or big customer has asked for a plan
- You are the only person who knows how things work
Not for you if
- You have no website, payments or customer data online
- You need a certified ISO 22301 programme
- You already have a tested plan from your IT provider
Questions
07Asked and answered
£299, once. That covers the inventory of your accounts and systems, the first-five-minutes triage page, 10 written plans, the kill-switch list, the continuity plan and one drill with you. There is no monthly fee. If your setup changes a lot later, an update is quoted as a small job, and changing names and phone numbers is something you can do yourself.
Site completely down, site up but broken, payments failing, nobody can log in, database trouble, emails not sending, rolling back a bad change, a data breach, a supplier like your host or payment provider being down, and your own PC dying mid-incident. They match the 10 plans in the GigXchange runbook, rewritten for your systems. Each one starts with how to tell it is happening and ends with how to know it is over.
A kill switch is a setting that turns one feature off fast, without a developer or a new release. If an automated email starts sending to everyone, or a feature starts costing money, you flip one setting and it stops. We list the switches your systems already have, how to use each one and how to check it actually worked. For costs, Cloud Cost Controls adds an automatic one.
It covers containing the leak, recording what happened and deciding whether to report it. Under UK GDPR, a reportable breach must go to the ICO within 72 hours of you becoming aware of it, and the plan walks you through that decision. It links to the ICO's breach reporting page. The GDPR Compliance Kit adds the breach log and data map.
It is a real, written continuity plan, which is what most small-business insurers and procurement forms ask to see. It lists your accounts, what is and is not backed up, how long a rebuild takes and how the business carries on if you are out of action. It is not a certified ISO 22301 programme; if a buyer requires that, you need a specialist auditor.
5 working days. Days 1-2 are the inventory of accounts, suppliers and backups. Days 3-4 are the writing. Day 5 is a drill: we walk one plan with you start to finish and fix whatever it missed. The plans arrive as plain documents you can print and keep somewhere you can reach without your computer. We need one call with you at the start, access to a list of your accounts, and an hour for the drill.
Because a template names no real systems, and a plan only works if it does. On the day you need the actual login page, the actual support number and the actual switch to flip. Writing those down is the work. The GigXchange runbook is useful precisely because every step names a real system, and yours is built the same way.
It covers the response; spotting problems early is a separate job. The plans start from the moment you know something is wrong. To find out within hours instead of from a customer, add Synthetic Monitoring, which tests your sign-up and login every 2 hours and points its alerts at the matching plan. The Operations Command Centre then shows the health of everything on one screen.