Skip to main content

Preparing, in peacetime

This is the half of the product that serves 99 % of the time, and the one that decides what happens on the day.

What the dossier holds​

  • The crisis directory — people, their role, their cell, their deputy, and above all their personal contact details.
  • Third parties to activate — incident response provider, cyber insurer, legal counsel, hosting provider, carrier, authority. With contract reference, emergency number, who is entitled to call, and what to do if nobody answers.
  • Response sheets — by crisis type and by role.
  • The document kit — the papers you do not go looking for on the day.
  • Business applications — criticality, owner, paper fallback, acceptable downtime.
  • Stakeholders to notify — with their regulatory deadline and the text that grounds it.

Versioned, and frozen at declaration​

The dossier is valid-time versioned: each change creates a version, and earlier ones stay readable.

When a crisis is declared, the current version is frozen. Six months later, you replay the crisis with the directory and the sheets of that day, not today's. That is what lets you answer "why did you call that provider?" without reconstructing from memory.

The preparedness indicator​

It does not score for the sake of scoring: each gap names the action that closes it.

Essential third parties on record — critical Missing: Incident response / CERT, Cyber insurance, Legal counsel. Add these third parties: without them, nobody to investigate, to pay, or to say what is allowed.

A point with nothing to check reads "not applicable", never "good". An empty dossier used to turn contract expiry green — because there were no contracts. A vacant green reads exactly like an earned one, and that is the worst lie a preparedness indicator can tell.

Building the dossier without retyping everything​

The directory already exists somewhere: a spreadsheet, a payroll export, an on-call list. CSV import accepts the usual headers and their synonyms.

It refuses the whole file as soon as one row is invalid, and returns the line number and the reason. A half-imported directory is worse than no directory, because you will believe you have one.

Checking that it holds​

A verification campaign sends each person a link: they confirm or correct their details in one click. The response rate is the only honest measure of how fresh a directory is.

And the paper export: print it. It is what stays readable when everything is encrypted, network included — that is, when Kastell itself is out of reach.