AI can make phishing, impersonation, malware development and reconnaissance faster or more convincing, while AI tools deployed inside your own organization add systems and data that must be secured. That does not prove AI has caused a worldwide rise in attacks. It does mean prevention alone is an unsafe strategy. A digital disaster plan prepares people, decisions, essential operations, backups and recovery steps for the incident that gets through.
Use “digital disaster plan” as a plain-language umbrella for three connected disciplines: incident response (what you do during an attack), business continuity (how essential work continues), and disaster recovery (how systems and data are restored). The plan below is written for small organizations, but the same logic can be scaled down for a household.
As an Amazon Associate I earn from qualifying purchases.
What AI changes about cyber risk
The European Union Agency for Cybersecurity (ENISA) says threat groups primarily use AI to facilitate or enhance activities they already conduct. Examples include generating more credible social-engineering messages, improving impersonation, automating reconnaissance and helping attackers adapt their workflow. The careful conclusion is that AI increases the reach, speed or quality of some abuse; the available evidence does not establish that AI is the sole cause of a general increase in cyberattacks.
AI also creates a defensive obligation. A business may now have model accounts, application programming interfaces, plug-ins, data stores, automated agents and third-party AI providers. Each can hold sensitive information, make decisions or connect to other systems. ENISA describes these cyber dependencies as an expanded attack surface. An outage or compromise at a provider can therefore interrupt your operations even when your own network was not the original target.
#1 Best Overall
ENISA’s analysis of financially motivated activity observed during 2025 illustrates the mix of threats, not the worldwide total of attacks: ransomware represented 40% of analysed activity, data breaches 31%, and fraud or impersonation 19%, according to its 2026 report release. Treat those figures as a description of reported, analysed events in ENISA’s scope, not as a risk percentage for your organization.
Resilience is the practical response. NCSC chief executive Richard Horne put the requirement plainly in the 2026 RUSI Annual Security Lecture: “The ability to absorb cyber attacks, contain their impact, sustain critical operations and recover quickly is no longer optional. It is a core competence for any digital organisation.”
What belongs in a digital disaster plan?
Keep the three plans connected, but do not make one document so vague that nobody knows what to do. The Canadian Centre for Cyber Security distinguishes them by purpose:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute| Plan | Primary question | Decisions and outputs |
|---|---|---|
| Incident response plan (IRP) | What do we do when an incident is suspected or confirmed? | Who declares the incident, isolates systems, preserves evidence, communicates, and coordinates technical or legal help. |
| Business continuity plan (BCP) | How do we keep critical services operating during disruption? | Essential functions, dependencies, people, manual workarounds, alternate locations or systems, and tolerable interruption times. |
| Disaster recovery plan (DRP) | How do we restore trusted technology and data? | Recovery order, backup sources, credentials, rebuild procedures, validation tests and return to normal operations. |
A single “digital disaster plan” can contain these sections, provided each has an owner and a clear trigger. Personal preparedness may use the same structure with simpler language: protect accounts, keep an offline copy of irreplaceable files, decide how to communicate if devices are unavailable, and document how to recover.
Rank #2
Step 1: Decide what must keep working
Start with operations, not products. List the services that would cause the greatest harm if they stopped: accepting payments, serving customers, dispatching staff, accessing medical or financial records, shipping orders, or communicating with employees. For each service, record who depends on it, the information it needs, the systems and suppliers behind it, and the longest interruption the organization can tolerate.
Build a critical-service register
- Name the service in business terms, not only by software product.
- Identify the data, accounts, devices, networks and external providers required to deliver it.
- Assign an accountable owner and a deputy who can act when the owner is unavailable.
- Define a minimum acceptable service and a temporary workaround, such as paper forms, a secondary communications channel or manual approval.
- Set recovery priorities. The most visible application is not always the most important dependency.
Record assumptions, including which functions can operate offline and which require a supplier. This inventory becomes the basis for both continuity decisions and restoration order.
Step 2: Write an incident-response playbook
People under pressure will not infer authority from a diagram. Put names, alternates and contact methods in a version that remains available when the main network is down. NCSC and Canadian guidance emphasize roles, escalation, communications and recovery priorities, and NIST’s 2025 incident-response guidance treats response as part of continuing cybersecurity risk management rather than a one-time binder.
Free tools Windows power users keep installed
One-click scans. No signup required.
Assign decision authority
- Incident commander: declares the incident, sets priorities and ends the response phase.
- Technical lead: coordinates isolation, investigation, password resets, restoration and evidence handling.
- Operations lead: activates workarounds and confirms which services must continue.
- Communications lead: gives staff, customers, suppliers and leadership consistent updates.
- Risk, legal or privacy contact: assesses contractual, regulatory and insurance obligations and coordinates required notifications.
- Supplier coordinator: opens support cases and confirms the status of critical providers.
Specify who may shut down a system, block network traffic, disable an account, approve emergency spending and authorize restoration. Include out-of-band contact methods and a printed or otherwise offline copy of the call tree.
Rank #3
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
Use a consistent activation sequence
- Record the signal. Note what was observed, when, by whom and on which systems. Do not destroy logs or wipe a device before deciding how evidence will be preserved.
- Declare or classify the incident. The incident commander decides whether the event is a suspected compromise, a service outage, a supplier incident or a false alarm.
- Contain safely. Isolate affected devices or accounts, block malicious traffic where necessary and prevent the incident from spreading. Avoid broad actions that erase evidence or disable critical life-safety functions without approval.
- Protect identities. Reset credentials from a trusted device, revoke stolen sessions and secure privileged accounts. Australian government guidance specifically recommends exercising the ability to block network traffic and reset passwords.
- Communicate on a schedule. Tell staff what to stop doing, where updates will appear and how to report symptoms. Give customers and suppliers only confirmed information, with a named contact for questions.
- Recover in priority order. Restore a clean, essential service first, validate it, then proceed to the next dependency. Keep heightened monitoring in place after restoration.
- Close and improve. Capture the timeline, decisions, costs, control failures and changes required before declaring normal operations.
Step 3: Make backups useful against ransomware
A backup that an attacker can reach with the same credentials as production is not a dependable recovery copy. CISA guidance recommends keeping critical backups offline and encrypted, testing their integrity and availability through restoration exercises, and maintaining updated golden images for critical systems where applicable. Accessible backups may themselves be deleted or encrypted during ransomware.
Compare backup approaches by recovery properties
| Approach | Isolation from production | What to verify | Main limitation |
|---|---|---|---|
| External hard drive for offline backups | Strong only while disconnected and protected from unauthorized access | Encryption, rotation, current contents and a successful restore to a separate device | A single drive can be lost, damaged or become outdated; it is not automatically sufficient for every organization. |
| Offline or otherwise isolated repository | Designed to separate recovery copies from everyday accounts and networks | Who holds credentials, how isolation is enforced, retention, encryption and restoration time | Configuration and access controls still require maintenance and testing. |
| Online synchronization alone | Usually connected to the same identity and network environment | Version history, deletion protection, independent credentials and whether a clean historical copy can be restored | Ransomware or a compromised account may encrypt or delete synchronized data. |
Choose a recovery point that matches the amount of work the organization can afford to lose, and a recovery time that matches the interruption limits in the continuity plan. Keep encryption keys and recovery credentials available to authorized people without storing them only on the systems being restored. Test a representative file and a complete system restoration; a backup is an assumption until the restore succeeds.
Step 4: Rehearse containment and recovery
Schedule exercises at least when systems, staff or suppliers change. A tabletop exercise can test decisions without touching production; a technical exercise can test isolation, password resets, golden-image deployment and restoration. Australian guidance recommends practicing the ability to block network traffic and reset passwords, not merely writing those actions in a document.
Recommended Free Tools
Run a practical exercise
- Present a scenario, such as a ransomware alert, stolen administrator session or outage at an essential provider.
- Ask who declares the incident and which service receives priority.
- Walk through contact methods if email and collaboration tools are unavailable.
- Verify that the team can identify affected assets, isolate them and preserve useful evidence.
- Restore a clean system or sample data and have the service owner confirm that it works.
- Record every delay, missing credential, unclear approval and dependency, then assign a deadline and owner for each fix.
Exercise results are more valuable than a polished plan that nobody has used. Keep an offline copy of the current version, but control revisions so staff do not follow obsolete contacts or recovery instructions.
Step 5: Include suppliers, AI tools and other dependencies
Map providers that can stop your service: cloud platforms, payment processors, managed IT companies, identity systems, communications services, software vendors and AI platforms. NCSC warns that highly disruptive incidents can originate in dependencies rather than a direct attack on your organization. ENISA similarly identifies interconnected dependencies as part of the expanded attack surface.
For each critical provider, record a support route that does not depend on the provider’s normal login, the data and functions it supplies, contractual recovery commitments, an alternate process and the person authorized to make a change. Ask what happens if the provider’s account system, API or customer portal is unavailable. For internally deployed AI, document model accounts, data flows, permissions, logs, human approval points and a safe shutdown or fallback procedure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you think you are being hacked now
Do not improvise a destructive response. Use the playbook, and get qualified incident-response or IT help when the impact exceeds your expertise.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Move coordination to a trusted channel and alert the incident commander.
- Disconnect or isolate clearly affected devices when doing so will not endanger critical operations; do not reconnect them just to “see if the problem is fixed.”
- Protect administrator and other high-value accounts from a known-clean device, revoking sessions and resetting credentials according to the plan.
- Preserve relevant logs, ransom notes, suspicious messages and timelines. Avoid paying or negotiating without appropriate legal and executive advice.
- Contact critical suppliers, insurers or authorities through pre-recorded routes where required, and keep a written decision log.
- Restore only from trusted, tested copies after containment and validation, then monitor for renewed access.
How small organizations and households can scale the plan
For a small organization
Start with one page listing the top five critical services, decision-makers, suppliers, communication methods, backup locations and recovery order. Expand it after the first exercise. External cybersecurity or IT consultants were the most commonly cited individual source of advice in the UK Department for Science, Innovation and Technology’s 2025/2026 survey, reported by 27% of businesses and 13% of charities. A consultant is useful only when the engagement identifies contacts, authority, backup access and a tested recovery action.
Best Value
For an individual or household
Use unique, multifactor-protected accounts; keep an encrypted offline copy of irreplaceable documents and photos; store recovery codes somewhere separate from your primary device; and decide how family members will communicate if your phone, email or internet account is unavailable. Keep a printed list of essential contacts and a sequence for replacing a lost or compromised device. Enterprise controls are not necessary for every household, but the principles of isolation, trusted copies and practiced decisions still apply.
How prepared are organizations?
Preparedness is uneven. In the UK government’s 2025/2026 survey, 25% of businesses and 19% of charities reported having a formal incident-response plan. Among businesses, charities and other organizations using, adopting or considering AI, 24% of businesses and 27% of charities reported cybersecurity practices or processes for managing AI risks. Among organizations reporting a breach or attack in that survey, 43% of businesses and 28% of charities reported at least one such incident. These are UK survey results for that year, not a prediction of an individual reader’s probability or a worldwide estimate.
Use those figures as a warning against assuming that a plan is standard practice. Review your plan whenever a critical system, supplier, AI use, backup arrangement or responsible person changes. NIST’s 2025 guidance places incident response inside an ongoing risk-management cycle, so an annual document review is the minimum, not the finish line.
Quick Recap
Common planning failures and fixes
- “Our files are synced, so we are backed up.” Check whether an attacker can encrypt or delete the synchronized copy. Add an isolated, encrypted copy and perform a restore.
- “The IT provider will handle it.” Name your internal decision-maker, confirm the provider’s emergency route and test access if its portal is unavailable.
- “Everyone knows what to do.” Write authority, alternates and first actions. Run a short exercise with the people who will actually respond.
- “We will restore everything at once.” Set recovery priorities based on critical services and dependencies, then validate each restored service before moving on.
- “AI is only a productivity tool.” Inventory its accounts, data, integrations and permissions, and define a fallback if the tool or provider is compromised or unavailable.
- “The plan is confidential and stays on the server.” Keep a controlled offline copy with the contacts and recovery information needed during a network outage.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
