It is 7:40 on a Monday morning and nobody can open a file. A ransom note is on every screen. Who do you call first? Who is allowed to shut systems down? Who talks to customers, and what do they say?
If the answer is “we would figure it out,” you are not alone, but you are taking a big risk. Decisions made in the first few hours of an incident often determine how much data is lost, how long the business is down and how much the recovery costs.
Why it matters
The first hour decides a lot
Without a plan, people improvise. Someone reboots the server and wipes evidence. Someone emails the whole company from the compromised account. Nobody knows the cyber insurance policy number, or that the insurer requires you to call its hotline before hiring anyone. The IT provider’s after-hours number is saved in an email account that nobody can get into.
None of this happens because people are careless. It happens because they are under pressure, making decisions they have never practiced, with systems they cannot trust.
An incident response plan is not paperwork. It is the difference between a bad day and a bad month.
What a small business plan should cover
It does not need to be a 100-page binder. A few clear pages, printed and stored where people can find them even if the network is down, are far more useful than a perfect document nobody has read. The U.S. National Institute of Standards and Technology recently updated its incident response guidance, NIST SP 800-61 Revision 3, and one of its key messages applies to businesses of any size: incident response is not a separate emergency procedure, it is part of how you manage risk every day. Preparation is where most of the value is.
- Who is on the team: A decision-maker, your IT contact or provider, someone for communications and, if needed, legal counsel. Include cell numbers and backups for each role.
- Who can make the call: Name the person authorized to disconnect systems, shut down email or bring in outside help, and who stands in if they are unreachable.
- Key phone numbers: IT provider, cyber insurance claims line, bank fraud department, attorney and the FBI field office or IC3 reporting site.
- First steps by scenario: Ransomware, a compromised email account, a lost laptop and a fraudulent payment each need a short checklist of their own.
- How to communicate: A backup channel, like a group text, if email and chat are down, plus simple holding statements for staff and customers.
- Where things are: Backups, admin credentials in a secure vault, network diagrams and a list of critical systems in priority order.
Check your cyber insurance first
If you carry cyber insurance, read the policy before you write the plan. Many policies require you to call a specific breach hotline first and to use the insurer’s approved forensic firms and lawyers. Hiring your own vendor in the heat of the moment can put coverage at risk. Put the hotline number and policy number at the very top of page one.
If you do not have cyber insurance, the process of applying is a useful checklist in itself. Insurers ask about MFA, backups, patching and training because those are the controls that most often decide how bad an incident gets.
A realistic scenario
Same attack, with and without a plan
Without a plan, the Monday morning scene looks like this: the office manager calls three different people, one of whom tells everyone to restart their computers. By the time the IT provider arrives at noon, the attackers have had four more hours. The insurer later questions a vendor that was hired without its approval.
With a plan, the first employee who sees the ransom note unplugs from the network and calls the name on the printed sheet. The decision-maker has the insurer’s hotline number in hand, the IT provider isolates affected systems within the hour, and a pre-written message goes out to staff by group text: do not log in, do not reply to anything, wait for instructions. The recovery still hurts, but it is organized, and tested backups do the rest.
Practice it once a year
A plan nobody has rehearsed tends to fail at the first surprise. A tabletop exercise fixes that without touching a single system. Gather the team for an hour, walk through a scenario, like “the owner’s email is sending fake invoices to clients,” and have each person say what they would do next. You will find the gaps quickly: a missing phone number, a vendor who does not answer on weekends, a backup nobody knows how to restore.
- Pick one scenario per session. Rotate through ransomware, email compromise, a fraudulent wire and a stolen laptop over time.
- Keep it low-stress. The goal is to find weaknesses in the plan, not in people.
- Write down the fixes and update the plan the same week.
Call your cyber insurer early. Many policies require prompt notification and provide access to approved breach response firms. Using unapproved vendors can affect coverage, so know the process before you need it.
Start this week
Open a blank document and answer three questions: who decides, who do we call and where are our backups? Print it, put a copy at home and a copy in the office, and share it with whoever would be on the team. That one page is already a real improvement. Then expand it with checklists for the scenarios most likely to hit you; for many small businesses, the top two are ransomware and fake payment requests from the “boss”.
Leave a Reply