INCIDENT RESPONSE GUIDE
Cybersecurity incident response plan for small businesses
Prepare the people, contacts, decisions and recovery steps your business will need when normal systems cannot be trusted.
A cybersecurity incident can begin with a stolen password, fraudulent email, lost device, malicious software, exposed customer information or unavailable cloud service. During the first hours, uncertainty and rushed decisions can cause as much damage as the original event.
An incident response plan gives the business a controlled way to identify what happened, protect people and systems, make required notifications, restore priority operations and record decisions. It should be short enough to use under pressure and detailed enough that responsibilities are not improvised.
An incident response plan is a business plan
Technical specialists may investigate accounts, devices and logs, but leadership must make decisions about operations, customers, money, privacy, insurance and communications. The plan therefore needs named business and technical roles—not only a list of security tools.
Define what counts as an incident, how employees report it, who determines severity and who can authorize disruptive actions such as isolating systems, disabling accounts, contacting law enforcement or restoring from backup.
Twelve things to prepare before an incident
Name an incident lead and alternates
Assign authority for coordinating the response. Document an alternate in case the primary person is unavailable or directly affected.
Build an offline contact list
Include leadership, IT support, cloud and hosting providers, financial institutions, insurer, legal and privacy advisors, key vendors and relevant reporting channels. Keep a current copy outside normal systems.
Identify critical systems and data
List email, identity, finance, customer records, websites, cloud storage, line-of-business applications, devices and network services. Record business owners and recovery priorities.
Define severity levels
Use simple criteria based on operational interruption, sensitive information, financial impact, number of users, attacker access and public or safety consequences.
Document decision authority
Clarify who may disable accounts, disconnect equipment, stop payments, engage specialists, notify customers and approve public statements.
Establish a reporting channel
Employees need a simple way to report suspicious activity. Provide an alternative telephone number or channel that remains available if email or collaboration systems cannot be trusted.
Prepare scenario playbooks
Create short checklists for compromised email, ransomware, lost devices, fraudulent payments, website compromise, data exposure and unavailable cloud services.
Confirm logging and time settings
Enable appropriate audit and security logs, protect them from unnecessary alteration and synchronize system time so events can be reconstructed accurately.
Maintain tested recovery capability
Back up essential information and configurations, isolate appropriate copies and test restoration. Record the order in which important services should return.
Understand notification obligations
Identify privacy, contractual, regulatory, insurance and law-enforcement requirements that may apply. Record contacts and decision criteria, but obtain professional advice for the actual event.
Prepare communication templates
Draft internal instructions, customer notices and vendor requests that can be adapted after facts are confirmed. Name one authorized spokesperson.
Keep response tools accessible
Maintain secure administrator access, known-clean devices, recovery codes, configuration records and plan copies without placing sensitive credentials directly inside the incident plan.
Preserve evidence before making avoidable changes
Contain urgent harm, but record times, alerts, messages, screenshots, affected accounts and actions. Do not casually wipe devices, delete messages or destroy logs that may be needed for investigation, insurance, legal review or notification decisions.
The first response: eight controlled actions
How the response phases work together
Detection and analysis establish whether an event is an incident, what is affected and how serious it may be. Avoid promising a root cause before evidence is available. Record known facts separately from assumptions.
Containment limits damage. Actions may include isolating a device, blocking sign-in, revoking sessions, disabling forwarding, restricting network access or pausing a payment. Choose actions that balance urgency, evidence and operational impact.
Eradication removes the attacker’s persistence and the underlying weakness. This can require credential resets, removal of malicious rules or applications, patching, reconfiguration and rebuilding affected devices.
Recovery returns prioritized services using verified accounts, clean systems and tested data. Increase monitoring and confirm that the original compromise cannot simply re-enter.
Post-incident improvement documents what happened, which controls worked, what delayed the response and who owns each corrective action. Update plans, training, architecture and vendor responsibilities.
Examples of scenario-specific priorities
Compromised email
Protect the identity, revoke sessions, review MFA methods, forwarding rules and delegated access, search for related messages and warn affected contacts through trusted channels.
Fraudulent payment
Contact the financial institution immediately, preserve communications, notify leadership and follow the approved fraud and law-enforcement reporting process.
Ransomware or malware
Isolate affected systems, avoid spreading the infection, protect backups and logs, engage qualified response support and determine safe rebuilding and restoration steps.
Lost or stolen device
Confirm the user, device, encryption and data exposure; block access, revoke sessions, use approved device-management actions and document reporting requirements.
Suspected data exposure
Identify the information, affected people, access path and duration; stop further disclosure, preserve evidence and obtain prompt privacy and legal assessment.
Website compromise
Protect administrator access, preserve a copy for investigation, place the site in a safe state, identify malicious changes, rebuild from trusted sources and rotate exposed credentials.
Test the plan before the emergency
Run a short tabletop exercise at least annually and after major changes. Present a realistic scenario, ask each participant what they would do and verify that contacts, access, backups and escalation paths actually work. Record gaps and assign deadlines.
The Canadian Centre for Cyber Security recommends a written plan with responsibilities, contact information, handling instructions and reporting actions. Its small-organization guidance also recommends keeping the plan and contact information accessible if normal systems are unavailable and testing the plan with lessons learned.
Review official guidance on developing an incident response plan, foundational security actions for small organizations and the Canadian baseline controls. Related CommzzTech resources include the cybersecurity checklist, backup and recovery guide and phishing response guide.
Important: This article provides general information. Privacy, breach reporting, employment, insurance, contractual, legal and law-enforcement requirements depend on the incident and jurisdiction. Obtain qualified professional advice promptly.
NEED A PRACTICAL INCIDENT RESPONSE PLAN?
Prepare decisions and contacts before systems are under pressure.
CommzzTech can help organize systems, responsibilities, contact lists, scenario checklists and a tabletop review appropriate to your business.