How to write an incident response plan for a small business

What the plan document should contain

A small business plan does not need to be long. Five to ten pages that people will actually read beats a fifty-page binder. A practical template has these parts:

1. Scope and definitions. List what counts as an incident: a compromised email account, ransomware, a lost laptop, payment fraud, or a vendor breach that affects you.
2. Roles and contacts. State who decides, who does what, and how to reach them.
3. Severity levels. Use a simple three-level scale. For example: low (one account, contained quickly), medium (data may be exposed or several systems affected), high (operations stopped or sensitive data likely taken).
4. First-hour checklist. Write the steps below for your own systems.
5. Evidence and logging. Note what to preserve and where your logs are kept.
6. Communications. Name who speaks, include pre-drafted messages, and set up a backup channel outside company email.
7. Notification and reporting. Cover your insurer, counsel, law enforcement, regulators and customers, as applicable.
8. Recovery and lessons learned. Explain how you decide systems are safe to use again, and plan a short review afterward.

Keep a printed copy, plus a copy outside your main systems, such as on a personal phone or in a separate account. If ransomware encrypts the file server, any plan stored only on that server is gone too.

Assign roles and build the contact sheet

In a small business, one person often holds several roles. That is fine, as long as it is written down. Typical roles:

• Incident lead. Makes decisions and keeps the timeline. Usually the owner or office manager.
• Technical lead. Your internal IT person or outside IT provider. Handles containment and recovery.
• Communications lead. Handles messages to staff, customers and media after counsel reviews them.
• Scribe. Records what happened, when, and who did what. This record matters for insurance and legal follow-up.
• A backup for each role, in case someone is on vacation.

The contact sheet is one printed page with names, mobile numbers and personal email addresses for:

• Each role and its backup
• Your cyber insurance carrier's claims or breach hotline, plus your policy number
• Your attorney
• Your IT provider and key software vendors (email, accounting, line-of-business systems)
• Your bank's fraud line
• Your local FBI field office
• Your internet provider and domain registrar

Review the sheet every six months. Phone numbers go out of date faster than anything else in the plan.

The first-hour checklist

When something looks wrong, these steps keep a bad day from getting worse:

1. Start the log. Write down the time, who noticed what, and every action taken from that point on.
2. Call the incident lead. Do not let one person handle it quietly alone.
3. Contain without destroying. Disconnect affected computers from the network or turn off their Wi-Fi. Do not power them off or wipe them unless your technical lead or your insurer's responders tell you to.
4. Secure accounts. From a device you know is clean, reset passwords and end active sessions for compromised accounts. Check that MFA settings and email forwarding rules have not been changed.
5. Protect the backups. Confirm backups are disconnected or immutable. Pause any job that could overwrite good copies with bad data.
6. Call your insurer's hotline if the incident may be covered. Many policies require prompt notice and expect you to use their approved responders.
7. Move to a channel outside company email. If email may be compromised, coordinate by phone or text.
8. Do not contact the attacker or pay anything until counsel and your insurer are involved.

Preserve evidence while you contain

Evidence tells you what happened and what data was reached. That drives notification decisions and insurance claims. Build these habits:

• Keep affected machines powered on but disconnected, unless told otherwise
• Photograph ransom notes and error screens
• Export cloud logs, such as Microsoft 365 or Google Workspace audit logs, before they are deleted under the retention period
• Preserve firewall and VPN logs
• Save suspicious emails as attachments instead of forwarding them around
• Do not run cleanup tools or reimage computers until you understand the scope

Find out ahead of time how long your systems keep logs. Some default retention periods are short, and extending them before an incident costs little.

Communications: staff, customers and the public

Poor communication can cause more damage than the incident itself. Plan for these points:

• Tell staff what they need to know and what not to do. They should not post about the incident or discuss it with customers yet.
• Have counsel review external statements before they go out.
• Include pre-drafted templates in the plan: a staff notice, a short customer holding statement and a vendor notice. Leave blanks for the facts.
• Watch for follow-on fraud. Attackers who have read your email may send fake invoices or payment change requests to your customers. Warn customers to confirm any payment change by phone.

When to call your insurer, counsel and law enforcement

• Insurer: Call as early as possible once you suspect a real incident. Late notice can complicate a claim. Read your policy now to learn its notice requirements.
• Counsel: Call when personal information, health information or customer data may be involved, or any time you face notification questions. California and other states have breach notification laws, and the requirements depend on the data and the facts. This guide is not legal advice.
• Law enforcement: Report cybercrime to the FBI through the Internet Crime Complaint Center (IC3) or your local field office. For payment fraud, also contact your bank immediately, because speed affects any chance of recovering funds.
• CISA: You can also report incidents to CISA. Reporting options and resources are at cisa.gov.
• Contracts and regulators: Defense contractors with covered defense information must report cyber incidents to DoD within 72 hours under DFARS 252.204-7012. See CMMC and NIST 800-171 readiness. Healthcare practices have HIPAA breach notification considerations. Also check your customer contracts for notification clauses.

Test it with a tabletop exercise

A tabletop is a 60 to 90 minute discussion in which your team works through a realistic scenario using the plan. No systems are touched. Common scenarios for small businesses:

• An employee's email account is taken over and fake invoices go out to customers
• Ransomware hits on a Friday afternoon and the bookkeeper cannot reach the accounting system
• A vendor tells you their systems were breached and your data may be involved

During the exercise, note every point where someone says "I'm not sure" or "I don't have that number." Each one becomes an action item. Run a tabletop at least once a year and after major changes.

Keith Systems offers incident response plan writing and tabletop exercises for small businesses in Santa Barbara County and southern San Luis Obispo County, on site or remotely. See incident response readiness, book a free security consult, or call (805) 800-8163.