Incident Response

Incident response, often abbreviated IR, is the discipline of deciding in advance how an organization will react when something goes wrong — rather than improvising under pressure while a breach is active. An IR plan names specific people responsible for specific actions: who calls the bank to freeze accounts, who notifies legal counsel, who contacts law enforcement, and who communicates with affected family members. The value is speed and clarity at exactly the moment when both are hardest to maintain.

For a family office, the stakes of a slow or disorganized response are high. Wire fraud, for example, operates on narrow time windows; funds can cross multiple institutions within hours. A hypothetical family office that discovers a fraudulent wire on a Friday afternoon needs a plan that works outside business hours, with direct contact names rather than general helplines. Families commonly build their IR plans before they believe they need them, precisely because a crisis is the wrong moment to start writing one.

A complete IR plan typically covers several categories: detection (how the office learns something is wrong), containment (stopping ongoing damage, such as revoking compromised credentials), notification (which regulators, insurers, or third parties must be told and on what timeline), recovery (restoring systems and accounts), and post-incident review (understanding what failed and why). Each phase has different owners and different timelines.

IR plans are closely tied to cyber insurance: many policies require a documented plan and specify that the insurer's own response vendors must be engaged before others. An IR plan also depends on having foundational controls already in place — such as multi-factor authentication and a password manager — so that containment steps are available and fast when a phishing or social engineering attack succeeds.