Why it matters
You need a plan before an incident, not during one — knowing who to call (police, regulator, CERT) saves critical time.
How a self-led small team implements it
A one-page list of relevant authorities and when to contact each is enough; you don't need a standing relationship yet.
What auditors expect to see
Documented list of relevant authorities and contact triggers.
Track A.5.5 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS