Out-of-band communications and incident call tree
When an attacker is inside your email or Teams, using them to coordinate the response tells the attacker your plans. Set up a printed contact sheet, an alternate channel and a call tree before you need them.
Reviewed by the ITRS security team · Last updated
Why you need out-of-band comms
In business email compromise cases, attackers commonly watch the compromised mailbox to see whether they have been noticed. In ransomware cases, email, Teams, the phone system and the shared drive holding the contact list may all be unavailable at once. Either way, the normal channels are the wrong ones.
NIST SP 800-61 Rev. 3 treats communication planning as part of incident preparation, and the Canadian Centre for Cyber Security's ransomware playbook advises preparing emergency documentation, including a contact list for employees, clients, service providers and suppliers, so you can react quickly. Out-of-band means a channel that does not depend on the systems that may be compromised.
Who goes on the sheet
For each person, record a mobile number, a personal or alternate email and the alternate channel they use. Our printable incident contact sheet lays this out.
- Incident lead and deputy
- Owner, CEO or managing partner, and whoever can approve emergency spending
- Finance lead (bank holds and payment stops)
- Privacy officer and HR lead
- IT provider's after-hours contact, and your incident responder
- Cyber insurer's claims line and policy number; broker
- Legal counsel
- Bank fraud department
- Domain registrar, internet and phone providers
- Key software vendors whose systems hold critical data
Alternate channels
| Channel | Good for | Watch out for |
|---|---|---|
Phone calls to mobiles | Urgent decisions, first contact | Numbers must be current; voicemail is not confirmation |
Group messaging app on personal phones | Ongoing coordination of the response team | Set it up in advance; verify members; avoid sharing sensitive evidence |
Conference bridge number outside your tenant | Scheduled status calls | Keep the dial-in on paper |
Separate email accounts | Sending documents to counsel and responders | Not created in the compromised tenant; MFA on |
In person | Sensitive decisions | Practical only for small teams |
Call tree order
Whoever spots it calls the incident lead
By phone, not email. If no answer within a few minutes, the deputy.
Incident lead calls the technical lead and responder
To start containment and evidence preservation.
Incident lead calls the executive sponsor
Who calls counsel and the insurer, or delegates it.
Finance lead is called if money may be involved
To contact the bank fraud line immediately.
Privacy and communications leads join once facts are clearer
For breach assessment and staff or client messages.
Staff are told what to do
Through managers by phone or the alternate channel: do not use email, do not discuss externally.
Storing and updating it
Keep paper copies at the office and with each decision-maker at home, a photo on each call-tree member's phone, and a copy in a secure location outside your main systems. Do not store it only on the shared drive, in SharePoint or in the email you are worried about.
Update it whenever a person on it leaves or changes role, and when you change insurer, bank, IT provider or counsel. Put a date at the top so everyone knows which version is current.
Call tree questions
As one copy, yes, if the password manager does not depend on the systems that might be compromised and the right people can reach it from a phone. Keep a paper copy as well.
No. The call tree is for the response team and decision-makers. Staff need one clear instruction through their managers, by phone or the alternate channel, about what to do and not do.
Then the deputy leads. Verification habits matter here: instructions that seem to come from a compromised person should be confirmed by calling them on a known number.
Testing it
Once a quarter, the incident lead calls through the tree outside business hours and notes who answered, how long it took, and which numbers were wrong. Once a year, run a tabletop exercise in which email and Teams are declared unavailable from the start and the team has to coordinate only through the alternate channel. The gaps show up quickly.
We can facilitate that exercise and review your contact sheet and plan against how your systems actually fail.
Related reading.
- ToolIncident contact sheet (printable)A fill-in sheet of everyone you will need to reach during a cyber incident, from your own decision-makers to your insurer, bank and regulators.
- GuideWriting an incident response plan that works for a small organizationA usable incident response plan is short enough to read under stress and specific enough to act on.
- ServiceIncident response tabletop exercisesA facilitated, discussion-based rehearsal of a realistic incident, so leadership and IT find the gaps in your plan in a meeting room rather than during a real attack.
- PracticeCyber Forensics & AssuranceIncident response, digital forensics, penetration testing and independent attestation.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.