When you have to switch everything off, how do people reach you?
A cyber incident now often means choosing to switch systems off. Email, Teams or Slack, and the contact centre usually go together, because they share one sign-in. Your contact centre belongs in your minimum viable company. We build a standby on Amazon Connect Customer in advance, independent of your corporate sign-in, so your customers still get through and your staff still know what to do.
In October, this stopped being hypothetical
On 21 October, PHP released emergency fixes for two critical vulnerabilities, now known as PHP2Shell. The NCSC warned more than 50,000 UK organisations that they were exposed, and its advice was to patch or take the system offline. 32 UK government services went offline. Oxford City Council and the City of Edinburgh Council took their websites down. Switching off was the right call. It also left a hard question: when the website, email and Teams or Slack are off, how do customers and colleagues get the information they need?
UK organisations warned by the NCSC about PHP2Shell (ITV News, 22 October 2026)
UK government services taken offline (ITV News, 22 October 2026)
Council websites taken offline (ITV News, 21 October 2026)
A staff emergency line for when you have to switch everything off
An admin updates the line from a phone with a PIN. Every colleague gets a text. A colleague asks whether she can use her laptop, and the answer changes when the facts change. Then she asks for a password reset, three ways, and the line refuses every time.
The company is fictional. The calls are dramatised by CloudInteract colleagues on a real Amazon Connect Customer instance. The AI agent and narrator voices are AI-generated.
One standby, two lines, built before you need them
What your customers hear
Your main number still answers. Callers hear a holding message written for the day. An AI agent answers the questions your website would normally answer. Vulnerable or urgent callers go straight to a person, and everyone else gets a callback, with every contact captured. It all runs on a standby contact centre on Amazon Connect Customer in a separate AWS account, with its own users and its own sign-in. Agents work from any browser, or take calls on their mobiles if laptops are quarantined. There are no seat licences or monthly minimums, so it can sit ready for a small running cost.
What your staff hear
A number every colleague already has saved, on the same standby. An admin updates it from any phone. A text tells everyone there's a new update. An AI agent answers the questions everyone asks, the latest update always wins over the pre-written guidance, and it never resets a password.
A diversion you've agreed in advance
Porting isn't a crisis tool: UK ports can take days, sometimes weeks. We help you agree a disaster recovery routing plan with your carrier, and write down who can authorise it and how they'll prove who they are without corporate email.
If your backup depends on anything you might have to switch off, it isn't a backup.
That's why the standby has its own account, its own sign-in, recovery email on a domain outside your main tenant, and break-glass access held by two named people with hardware security keys.
The line gives information. That's all it does.
Helpdesks were reported as a way in during some of the 2025 retail attacks. So the emergency line never resets passwords, never changes account details, never approves access and never shares anyone's contact details, whoever the caller says they are. That's a hard rule for the AI agent, and it belongs in the human script too.
Two short playbooks
Prepare now
Build the standby outside the blast radius. Claim the numbers and agree the diversion. Publish the staff number. Hold staff contact data outside the estate. Pre-write the words. Lock down what the lines can do. Test it once a year.
The first 72 hours
Hour by hour, from declaring the incident and updating the staff line by phone, through switching on the diversion and putting AI agents on the common questions, to the ICO 72-hour reporting clock and the switch back.
Download both playbooks now
Enter your name and work email for instant PDF download of both playbooks.
Already on Amazon Connect Customer?
Global Resiliency fails your contact centre over to another AWS Region if a Region has a problem. A cyber incident is a different problem: it isn't the Region that's broken, it's your identity provider, your email and your laptops. Two different risks need two different answers.
Start with a readiness review
We walk through both playbooks against your current setup and give you a short list of the gaps. Then, if you want it, we build the staff line, the standby or both, and test them with you at least once a year.
AWS Advanced Tier Services Partner. Amazon Connect Service Delivery Partner. 8 Amazon Connect Ambassadors. Eight contact centre migrations completed, every one with zero downtime, up to 6,000 advisors.
Amazon Connect Customer carries AWS's published 99.99% monthly uptime SLA and inherits AWS's ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3 and PCI DSS attestations. These are AWS's, not ours. We are working towards ISO 27001, Cyber Essentials and Cyber Essentials Plus, all targeted for H1 2027.
General guidance, not legal or security advice. Use it alongside your incident response plan and the NCSC's guidance on communications in a cyber incident.