How do I write an incident contact list?

Short, current, and reachable when your usual systems are not:

• The providers - internet, hosting, email, bank, payment terminal, with account numbers.
• The people - IT support, accountant, insurer, and the staff who need to know.
• The reporting lines - ReportCyber and, if identity information is exposed, IDCARE.
• A printed copy - because the digital one may be inside the thing that broke.

Review it twice a year; contact lists rot faster than any other part of a plan.