Building an Incident Response Plan for Your Small Business in One Afternoon

Most small businesses do not have an incident response plan, and the reason is rarely carelessness. It is usually a sense that “incident response” belongs to big companies with security operations centers, legal departments and 80-page binders. The result is that when something does go wrong, such as a hacked email account, a ransomware note or a lost laptop full of customer data, the first hour is spent figuring out who to call instead of actually responding.

The good news is that a useful plan for a business of 5 to 100 people does not need to be long. It needs to answer a handful of questions clearly: who is in charge, who do we call, what do we do first for the incidents most likely to hit us, and what are we legally required to do afterwards. You can answer all of those in a single focused afternoon.

This guide walks you through that afternoon hour by hour, with a roles table, a severity scale, short playbooks for common scenarios and a simple way to test the result. By the end you will have a document of a few pages that your team can actually use under pressure.

What counts as an incident (and why it matters to define it)

A security incident is any event that threatens the confidentiality, integrity or availability of your information or systems. That definition is accurate but abstract, so it helps to list concrete examples your team will recognize. If people do not know what counts, they will not report it, and small problems grow into big ones.

For a typical small business, incidents include:

• An employee clicks a link and enters their password on a fake login page.
• A staff member’s email account starts sending messages they did not write.
• Files on a computer or shared drive suddenly have strange extensions and a ransom note appears.
• A laptop, phone or USB drive containing business data is lost or stolen.
• A vendor’s “new bank details” turn out to be fraudulent after a payment is sent.
• Customer or patient information is sent to the wrong person or exposed in a public link.
• A key cloud service, website or payment system goes down for unexplained reasons.
• A vendor or IT provider tells you they have had a breach that may affect your data.

Put a short version of this list at the top of your plan, followed by one sentence that matters more than anything else in the document: “If in doubt, report it immediately to [name] at [phone number]. You will never get in trouble for reporting something that turns out to be harmless.”

Before you start: what to gather (30 minutes)

Block out about four hours. Invite the owner or general manager, whoever manages IT (internal or your outside IT provider), and someone from finance or operations. Before you begin writing, collect the information you will need so you are not hunting for it later.

If you discover during this step that nobody knows where the backups are or who holds the admin password for your accounting system, that is a valuable finding in itself. Write it down as an action item. Our guide to the 3-2-1-1-0 backup strategy can help you close that gap.

Hour one: assign roles and build your contact sheet

In a crisis, confusion about who decides what wastes more time than any technical problem. Even in a five-person company, assign these roles by name, with a backup for each.

Role	Responsibilities	Typical person in a small business
Incident lead	Declares an incident, makes final decisions, approves spending, keeps everyone focused.	Owner, CEO or general manager
Technical lead	Investigates, contains the problem, coordinates with IT provider and forensic specialists.	Internal IT person or managed service provider
Communications lead	Drafts messages to staff, customers and partners; handles media if needed.	Office manager, marketing or operations lead
Finance and legal liaison	Contacts bank, insurer and attorney; tracks costs for the insurance claim.	Finance manager or bookkeeper
Record keeper	Keeps a timestamped log of what was observed, decided and done.	Anyone organized and calm; often the communications lead

Next, build a one-page contact sheet. Include mobile numbers, not just email addresses, because email may be the thing that is compromised. Your external contacts should include:

• IT provider (business hours and emergency lines)
• Cyber insurance claims or breach hotline and your policy number
• Bank fraud department
• Attorney, ideally one with data breach experience or one your insurer recommends
• Key software vendors’ support lines (accounting, practice management, point of sale)
• Your local FBI field office and the FBI’s Internet Crime Complaint Center (IC3) for reporting cybercrime

Many cyber insurance policies require you to notify the insurer quickly and to use their approved response firms. Calling a random forensics company first can put your coverage at risk, so check your policy and note the requirement prominently in the plan.

Hour two: define severity levels and escalation

Not every incident needs the owner on the phone at midnight. A simple severity scale helps people decide how fast to act and who to involve. Keep it to three or four levels and use examples rather than technical criteria.

Severity	Examples	Who to involve	Response time
Low	Phishing email reported but nobody clicked; single malware alert blocked automatically.	Technical lead	Same business day
Medium	Someone entered a password on a phishing page; lost laptop that is encrypted.	Technical lead and incident lead	Within 2 hours
High	Confirmed account takeover; suspected payment fraud; sensitive data sent to the wrong person.	Full response team, bank if money is involved	Immediately
Critical	Ransomware spreading; business cannot operate; large-scale data theft.	Full team, insurer, attorney, IT provider	Immediately, around the clock

Add a short rule for escalation: if anyone is unsure between two levels, choose the higher one. It is easy to step down later and costly to discover you should have acted faster.

Hour three: write playbooks for your most likely incidents

A playbook is a short, numbered checklist for a specific type of incident. You do not need dozens. Four or five cover the vast majority of what small businesses actually face. Keep each to a single page and write in plain language so a non-technical person can follow the first steps while waiting for help.

Compromised email account

1. Reset the account password from a known-clean device and sign the user out of all sessions.
2. Confirm multi-factor authentication is on, and remove any MFA methods the user does not recognize.
3. Check for new inbox rules, forwarding addresses and connected apps, and delete anything suspicious after taking a screenshot.
4. Review sent items and deleted items for messages the attacker sent, especially anything about payments or bank details.
5. Warn contacts who may have received fraudulent messages, by phone if money could be involved.

Ransomware or widespread malware

1. Disconnect affected computers from the network (unplug the cable or turn off Wi-Fi). Do not power them off unless your IT provider says to.
2. Call your technical lead and your insurer’s hotline.
3. Protect backups: disconnect any backup drives and confirm cloud backups have not been altered.
4. Do not contact the attackers or pay anything until you have spoken with your insurer, attorney and response firm.
5. Begin your record keeper’s log immediately, including photos of any ransom notes.

For a deeper look at prevention and recovery, see our guide to ransomware prevention and recovery.

Payment fraud or suspicious bank change

1. Call your bank’s fraud department immediately and ask them to attempt a recall of the transfer.
2. File a complaint at ic3.gov with transaction details.
3. Treat the email account involved as compromised and follow that playbook.
4. Contact the real vendor or executive using a phone number you already have on file.

Lost or stolen device

1. Report it to the technical lead as soon as the loss is noticed.
2. Use your device management tool to lock or wipe it remotely.
3. Change passwords for accounts that were signed in on the device.
4. Determine whether the device was encrypted and what data was on it; this decides whether notification laws apply.

Data sent to the wrong person or exposed

1. Ask the recipient to delete the information and confirm in writing.
2. Remove public sharing links and check access logs if available.
3. Document what data, how many people and how long it was exposed.
4. Contact your attorney to assess notification obligations.

Notification and legal duties

Every US state has a data breach notification law, and the rules differ on what counts as personal information, how quickly you must notify and whether you must also inform the state attorney general. Industry rules add further obligations. Your plan should not try to summarize every law, but it should list which ones are likely to apply to you and who will make the call.

• HIPAA: if you handle protected health information, the Breach Notification Rule generally requires notifying affected individuals without unreasonable delay and no later than 60 days after discovery, plus notice to HHS.
• PCI DSS: if card data may be involved, your merchant agreement usually requires prompt notice to your payment processor or acquiring bank.
• GDPR: if you process data on people in the EU, notifiable breaches must generally be reported to the supervisory authority within 72 hours of becoming aware.
• Contracts: some customer and vendor agreements include their own notification deadlines.

The FTC’s Data Breach Response: A Guide for Business is a clear, free reference worth linking in your plan.

Hour four: test the plan with a tabletop exercise

A plan nobody has rehearsed is a theory. A tabletop exercise is a guided discussion where the team talks through a realistic scenario using the plan. It requires no technology and takes about 30 minutes.

1. Pick one scenario, for example: “On Monday morning, the bookkeeper notices a vendor payment of $18,000 went to a new account last Friday after an email asking to update banking details.”
2. Ask each person what they would do in the first 15 minutes, using only the plan.
3. Add a twist halfway through, such as “the bookkeeper’s mailbox has a forwarding rule nobody created.”
4. Note every moment where someone hesitated, a phone number was missing or a decision had no owner.
5. Turn those notes into fixes before the end of the session.

If you want ready-made scenarios, CISA publishes free tabletop exercise packages that you can adapt to a small team.

Keeping the plan alive

An incident response plan goes stale quickly. People change roles, phone numbers change and you adopt new systems. A few habits keep it useful:

• Store it where you can reach it during an outage. Keep a printed copy in the office, a copy on the incident lead’s phone and one in a personal, separate cloud account. If ransomware encrypts your file server, a plan saved only on that server is useless.
• Review contacts every quarter. It takes ten minutes and prevents the most common failure: a wrong number at the worst moment.
• Run a tabletop exercise once a year and after any major change, such as switching IT providers or moving to a new cloud platform.
• Hold a short review after every real incident, even a minor one. Ask what worked, what did not and what you will change.
• Tell new employees during onboarding how to report an incident and who to call.

NIST’s updated incident response guidance, SP 800-61 Revision 3, frames incident response as part of everyday risk management rather than a separate emergency function. For a small business, that simply means treating the plan as a living document that improves every time you use it.

How SecuritySage can help

If you would rather not start from a blank page, we can help you build and test your plan quickly. Our Virtual CISO advisory service can facilitate the planning afternoon, write playbooks tailored to your systems and run a tabletop exercise with your team. The Security Policy Toolkit includes templates you can adapt yourself.

When you are ready, get started with SecuritySage and we will help you put a practical, tested plan in place. Secure your digital future today with SecuritySage, where cybersecurity meets simplicity, allowing you to focus on growth while we handle the rest.