How to Create a Strong Incident Response Plan for Small Businesses

When ransomware locks your files or a staff member realises they entered their password on a fake login page, the first hour matters enormously. Businesses that already know who to call, what to switch off and how to communicate recover faster and with less damage than those working it out under pressure. That is the purpose of an incident response plan: a written, tested guide to what your organisation does when a cybersecurity incident happens.

Many small enterprises assume such plans are only for large corporations with security teams. In reality, a smaller business often has more to lose from a disorganised response, because it has fewer people and less financial cushion. This guide walks you through building a practical plan that fits a small organisation, without unnecessary bureaucracy.

Why Small Businesses Need a Plan

Attackers do not only target big names. Small firms are attractive because they often have weaker defences while still holding valuable data, bank access and connections to larger customers. Common incidents include:

• Ransomware encrypting files and systems.
• Business email compromise leading to fraudulent payments.
• Stolen or phished account credentials.
• Lost or stolen laptops and phones containing company data.
• Accidental data exposure, such as emailing a spreadsheet to the wrong person.
• Website defacement or compromise.

A plan helps you act quickly, preserve evidence, meet legal notification deadlines, keep customers informed and get back to business. Many cyber insurers and larger clients now also expect suppliers to have one.

The Six Phases of Incident Response

Widely used frameworks, including guidance from NIST, describe incident response as a cycle. A simple version suited to small businesses has six phases.

Phase	Goal	Example actions
1. Prepare	Be ready before anything happens	Write the plan, set up backups, train staff, gather contacts
2. Identify	Recognise and confirm an incident	Review alerts, ask questions, record what is known
3. Contain	Stop it from spreading	Disconnect devices, disable accounts, block malicious senders
4. Eradicate	Remove the cause	Remove malware, close vulnerabilities, reset credentials
5. Recover	Return to normal operations	Restore from clean backups, monitor closely
6. Learn	Improve for next time	Hold a review, update the plan and controls

Step 1: Define Roles and Build Your Contact List

Who does what

Even in a business of ten people, everyone should know who leads during an incident. Assign these roles, noting that one person may cover several:

• Incident lead: makes decisions, coordinates the response and keeps a timeline.
• Technical lead: an internal IT person or your managed service provider who investigates and contains the problem.
• Communications lead: handles messages to staff, customers, partners and, if needed, the media.
• Legal and compliance contact: advises on notification duties, contracts and evidence.
• Executive decision-maker: approves major decisions such as shutting down systems or engaging outside specialists.

Name a deputy for each role in case the primary person is unavailable, on holiday or is the person whose account was compromised. Write the role holders and deputies on the first page of the plan so nobody has to search for them during an emergency.

Who to call

During an incident your normal email or phone system may be unavailable, so keep an up-to-date contact list both digitally and on paper. Include your IT provider, cyber insurer and their claims hotline, your bank’s fraud team, legal advisers, key suppliers such as your website host, and the relevant authorities. In the United States that includes reporting routes through CISA and the FBI; other countries have national cybersecurity centres and data protection regulators with their own reporting processes.

Prepare the essentials in advance

Several things are far easier to arrange calmly beforehand than during a crisis:

• Backups with at least one copy kept offline or in an immutable store, with a recent successful restore test.
• An asset list showing your key systems, where data is stored and who administers each service.
• Emergency administrator access that does not depend on your everyday email account.
• Logging switched on in your email, cloud and security tools, kept long enough to investigate.
• A simple way for staff to report something suspicious quickly and without fear of blame.

Step 2: Classify Incidents by Severity

Not every event needs the full plan. A simple three-level scale helps people respond proportionately:

1. Low: a single phishing email reported and deleted, no clicks. Log it and move on.
2. Medium: one account or device compromised but contained quickly, with no known data loss. Activate the technical lead and incident lead.
3. High: ransomware, confirmed data breach, fraudulent payment or major outage. Activate the full team, insurer and advisers immediately.

Step 3: Write Simple Playbooks

Playbooks are short checklists for your most likely incidents. Aim for one page each, written so a stressed non-specialist can follow them.

Ransomware playbook highlights

Disconnect affected devices from the network without switching them off, disable remote access, alert the incident lead and insurer, do not contact the attackers without professional advice, identify clean backups and preserve evidence for investigators.

Business email compromise highlights

Reset the affected account password, sign out all sessions, check for malicious mail forwarding rules, contact the bank immediately if a payment was made, and warn customers or suppliers who may have received fraudulent messages.

Lost device highlights

Record what data the device held, use remote lock or wipe, change passwords for accounts used on it and assess whether a data protection notification is required.

Keep a record as you go

Whatever the incident, the incident lead should keep a timeline: when it was discovered, who was told, what was observed and every action taken, with times. This log supports insurance claims, regulatory reports and the later review, and it prevents people repeating or undoing each other’s work.

Step 4: Plan Communications and Legal Duties

Prepare templates for internal updates, customer notifications and holding statements in advance. Understand your obligations under privacy laws in the places you operate; GDPR, for example, generally requires notifying the regulator of certain personal data breaches within 72 hours of becoming aware. Contracts with clients may set even shorter deadlines. Be factual, avoid speculation and coordinate messages through the communications lead.

Step 5: Test and Improve Your Incident Response Plan

A plan that sits untouched in a folder will fail when needed. Run a tabletop exercise at least once a year: gather the team, walk through a realistic scenario such as “the accounts manager receives a request to change a supplier’s bank details”, and talk through each decision. Note gaps, update contacts, and confirm that backups can actually be restored. After any real incident, hold a no-blame review and feed the lessons back into the incident response plan.

Good questions to ask after an exercise or a real event include:

• How quickly did we notice the problem, and who noticed it first?
• Did everyone know their role, and could we reach the people we needed?
• Which steps took longer than expected, and why?
• What single change would have prevented or limited the incident?

Assign an owner and a deadline to each improvement so the review leads to action rather than just a report.

Frequently Asked Questions

How long should an incident response plan be?

For a small business, a core document of a few pages plus one-page playbooks is usually enough. Clarity matters more than length.

Do we need an outside provider?

It helps. Many small firms rely on their managed IT provider or an incident response retainer, often arranged through their cyber insurer.

Should we pay a ransom?

Authorities generally advise against it, and payment may be restricted in some cases. Seek legal and insurer advice before any decision.

How often should the plan be updated?

Review it at least annually and whenever staff, systems, suppliers or regulations change.

Final Thoughts

An incident response plan turns panic into a process. By assigning roles, keeping contacts handy, preparing playbooks and practising regularly, even the smallest business can respond to cyber incidents calmly and effectively. Start with a simple version this month, test it with your team and improve it over time.