A small-business incident response plan should make it clear who leads, how to get help and how the business keeps a reliable record when systems or accounts may be compromised. Prepare it before an incident, and keep a protected copy accessible if normal email or shared storage is unavailable.
Name the people who can make decisions
Assign a response lead and an alternate. Record the IT or security support route, business decision maker, communications owner and relevant external advisers. Confirm how to reach them through a trusted alternative channel.
Use the NCSC small-business response and recovery guide as a planning resource. Adapt the process to your systems and location rather than copying another organisation’s contacts or reporting rules.
List the systems that keep the business running
Record essential services, owners, support providers and dependencies. Note where recovery instructions and backup information can be found without placing passwords or recovery secrets in a widely shared plan.
Identify which operations can continue manually and who decides when to use that fallback. Check assumptions such as whether payroll, customer support or order processing depends on the same identity system.
Define the first report
Give staff a simple route to report suspicious activity. Ask for what they observed, the time, affected device or service and any immediate business impact. Staff should not need to prove an attack before asking for help.
Have the response lead distinguish confirmed facts from suspected causes. Keep a dated incident log with decisions, actions and responsible people. Protect relevant evidence and have qualified responders guide technical investigation or containment; unplanned changes can destroy evidence or worsen an outage.
Prepare a short working template
- Incident record: reference, report time, reporter and initial observations.
- Leadership: response lead, alternate and current decision owners.
- Scope: affected services, accounts, data and known business impact.
- Actions: authorized containment and investigation steps, evidence location and outstanding questions.
- Communications: approved audience, spokesperson, message owner and next update time.
- Recovery: priorities, dependencies, validation and authorization to resume.
- Follow-up: lessons, corrective actions, owners and review dates.
Populate the contacts, authorities and system details before relying on the template. Have the responsible advisers identify contractual, insurance and legal reporting requirements for your business. Do not assume a universal notification deadline.
Agree how recovery will be accepted
Identify who checks that restored services work and that the incident has been addressed sufficiently to resume. Include data accuracy, access and connections to other systems. A service becoming reachable does not by itself prove that recovery is complete.
Exercise and maintain the plan
Run a discussion using a realistic outage or account-compromise scenario. Check contact availability, decision authority and missing dependencies. Our ransomware tabletop guide provides an illustrative format.
Assign fixes to named people and retest the important gaps. Review the plan after incidents, exercises and material changes to systems or staffing.