An incident response plan should be short enough to use under pressure and stored somewhere that works when your systems do not. This outline covers the sections most small businesses need.
Fill it in with your own names, numbers, and systems, print a copy, and rehearse it once a year.
Roles and contacts
- Name an incident lead and a backup.
- List contacts for your IT provider, insurer, attorney, and bank.
- List regulators or agencies you may need to notify.
- Keep this list offline as well as online.
First hour
- Confirm what is happening and record the time.
- Disconnect affected devices from the network, but do not wipe them.
- Reset credentials for affected accounts from a clean device.
- Call your insurer before engaging outside responders, if your policy requires it.
Contain and recover
- Identify the scope, including which systems, data, and accounts are involved.
- Restore from known-good backups in priority order.
- Monitor for repeat activity after recovery.
Communicate
- Decide who speaks to staff, clients, and partners.
- Meet legal notification requirements and deadlines.
- Keep a written log of decisions and actions.
Learn
- Hold a review within two weeks.
- Record root causes and the fixes made.
- Update this plan.
This template is general guidance, not legal, tax, or financial advice. Adapt it to your business and confirm requirements with a qualified adviser.