An incident response plan is the written playbook your business follows when a cyberattack or data breach happens. For a small business it should fit in about 10 to 20 pages and answer five questions: who is in charge, how you decide how serious an incident is, who you call (and in what order), what you do in the first hours for your most likely attacks, and how you meet legal, insurance and customer obligations afterwards. A plan that is short, current and rehearsed beats a 100-page template nobody has read.
Why small businesses need one
- The first hours decide the cost. Wiping an infected laptop before it's examined, or paying an invoice from a compromised mailbox, can turn a contained incident into a breach notification. See the hidden costs of ransomware.
- Your insurer expects it. Most cyber policies require you to notify the carrier promptly and use approved vendors. Calling your own forensics firm first can jeopardize coverage.
- Regulators and clients require it. The FTC Safeguards Rule, HIPAA, NYDFS Part 500 and SEC Regulation S-P all expect a written response program, and enterprise customers ask for it in security questionnaires.
What the plan should include
| Section | What to write |
|---|---|
| Purpose and scope | Which systems, data, locations and third parties the plan covers, and what counts as an incident |
| Roles and authority | An incident lead, a deputy, and who can approve shutting systems down, contacting law enforcement or paying for outside help |
| Severity levels | Three or four levels with clear triggers, so staff know when to escalate |
| Contact list | Internal team, IT provider, insurer's claims line, breach coach, forensics firm, bank fraud line, key clients and law enforcement, with after-hours numbers |
| Reporting | How any employee reports a suspected incident, and the promise that they won't be blamed for doing so quickly |
| Response phases | Preparation, detection and analysis, containment, eradication and recovery, and lessons learned |
| Playbooks | One-page checklists for your most likely incidents |
| Communications | Who speaks to staff, clients, media and regulators, and an out-of-band channel if email is compromised |
| Evidence and documentation | How to preserve logs and devices, and a timeline template |
| Legal and notification | Which breach notification laws and contractual deadlines apply, and who decides |
| Testing and maintenance | When the plan is exercised, reviewed and updated |
Roles: keep it small and named
In a 20- to 200-person business, the response team is usually four to six people. Name them, with a backup for each:
- Incident lead: runs the response and keeps the timeline. Often the COO, IT director or your vCISO.
- Executive decision-maker: approves business shutdowns, spending and any extortion-related decisions.
- Technical lead: your internal IT or MSP, who contains and restores systems.
- Legal and privacy: outside counsel or a breach coach, ideally engaged through your insurer so communications are privileged.
- Communications: one person who drafts every message to staff and clients.
Severity levels that people can actually use
| Level | Example | Response |
|---|---|---|
| Low | A phishing email reported and deleted, no clicks | Log it, block the sender, no escalation |
| Medium | One user entered credentials on a phishing page | Reset password, revoke sessions, check mailbox rules, notify incident lead |
| High | Confirmed account takeover, malware on a server or suspicious wire request | Activate the team, call IT provider, consider insurer notification |
| Critical | Ransomware, confirmed data theft or business stopped | Full activation, notify insurer immediately, engage forensics and counsel |
The response phases
NIST's incident handling guide, SP 800-61 Rev. 3, now frames incident response within the six functions of the NIST Cybersecurity Framework 2.0. For a small business, the familiar four phases remain the most practical way to organize the plan:
- Preparation. Asset inventory, logging, backups you've tested, MFA, the contact list and pre-agreed vendors. An incident response retainer belongs here.
- Detection and analysis. What alerted you, which systems and accounts are affected, and what data may be involved. Record times and actions as you go.
- Containment, eradication and recovery. Isolate affected devices rather than switching them off, disable compromised accounts, remove persistence, restore from clean backups and watch for the attacker returning.
- Post-incident activity. A lessons-learned review within two weeks, with owners and dates for each fix, and an update to the plan.
Playbooks for your most likely incidents
Write a one-page checklist for each of these. They cover the large majority of small business incidents:
- Business email compromise: revoke sessions, remove forwarding rules, check sent items and payment requests, call the bank. Our BEC first-24-hours checklist is a ready starting point.
- Ransomware: isolate from the network, don't wipe or reboot, protect backups, notify the insurer, and don't contact the attacker without counsel.
- Lost or stolen device: confirm encryption, remote wipe, revoke tokens, assess what data was on it.
- Vendor breach: determine what data the vendor held, rotate shared credentials and API keys, review your contract's notification terms. See vendor risk management.
- Payment fraud: call the bank's fraud line immediately, file with the FBI's IC3, and preserve the emails.
Notification obligations to map in advance
Under pressure, nobody should be researching deadlines. List the ones that apply to you, for example:
- Your cyber insurer's notice requirement (often "as soon as practicable")
- State breach notification laws for every state where affected individuals live
- Sector rules, such as HIPAA, the FTC Safeguards Rule's 30-day FTC notice, NYDFS's 72-hour notice, or DFARS 72-hour reporting for defense contractors (see our CMMC checklist)
- Contractual deadlines in client agreements, which can be as short as 24 hours
Test it at least once a year
A plan that hasn't been exercised will fail at its first real test, usually at the contact list. Run a two-hour tabletop exercise each year with leadership, walking through a realistic scenario such as ransomware on a Friday evening. Then update the plan with what you learned. Review it whenever key people, providers or systems change.
Common mistakes
- Storing the only copy on the network that just got encrypted. Keep a printed copy and an offline copy.
- Relying on email to coordinate when the attacker may be reading it. Agree an out-of-band channel in advance.
- No after-hours numbers. Attacks favor weekends and holidays.
- Calling your own forensics firm before the insurer, then finding the cost isn't covered.
- Restoring before you know how they got in, and being reinfected the same week.
Frequently Asked Questions
Does a small business really need a written incident response plan?
Yes. Regulators, cyber insurers and many clients expect one, and a written plan prevents the costly mistakes made in the first hours of an incident, such as wiping evidence or paying a fraudulent invoice.
How long should a small business incident response plan be?
Typically 10 to 20 pages, plus one-page playbooks for the most likely incidents. It should be short enough that the people named in it have actually read it.
What are the phases of incident response?
The classic four phases are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. NIST SP 800-61 Rev. 3 now aligns these with the NIST Cybersecurity Framework 2.0 functions.
Who should be on a small business incident response team?
An incident lead, an executive decision-maker, a technical lead (internal IT or your MSP), legal counsel or a breach coach, and one communications owner, each with a named backup.
How often should we test our incident response plan?
At least once a year with a tabletop exercise, and after any major change to your people, systems or providers.
Should we contact our cyber insurer before an incident response firm?
In most cases, yes. Many policies require prompt notice and the use of panel vendors. Check your policy now and put the claims hotline at the top of your contact list.
Need a plan your team can actually use? Defensible writes your incident response plan and playbooks, runs the tabletop exercise and stands behind you with a retainer if an incident happens. Talk to our team.
