You do not need a 40-page IR plan to be less fragile. Block ninety minutes and do this.
1. Offline or immutable backup check (25 min)
Confirm at least one restore path an attacker with Microsoft 365 admin rights cannot quietly delete.
2. Admin account inventory (20 min)
List Global Admins and local admin users. Remove what you can.
3. Emergency contacts (15 min)
MSP, cyber insurer, bank fraud line, key vendors, in a place available if email is down.
4. Communication stub (15 min)
Who tells staff? Who tells clients? One paragraph is enough to start.
5. Calendar the next drill (15 min)
Schedule a restore test and a tabletop for next quarter.
Want Qutzl to facilitate the session? Contact us.