Incident Response Plan for Small Business: A One-Page Template and How to Use It

Why write it down now

During an incident, people are stressed, information is incomplete and decisions have real consequences. A plan written in calm conditions gives you a head start: who to ring, what to isolate, what to avoid doing. Without one, small teams often lose precious time debating basics or, worse, take well-meaning actions such as wiping a machine that destroy evidence.

You do not need legal language or complex diagrams. A single page, in plain words, that people can find in under a minute is the target.

Section 1: roles and contacts

Start with people. Name an incident lead and a deputy with mobile numbers. Add the person responsible for communications, someone who can make financial decisions, and the contact for IT support. Then list external contacts in one table that can be printed.

• Incident lead and deputy, with personal phone numbers
• IT provider or managed security contact, with their out-of-hours number
• Cyber insurance helpline and policy number
• Legal or data protection adviser
• Bank fraud line and payment provider contact
• Key customers or partners who would need to be informed
• Relevant authority or reporting service in your country

Section 2: how to recognise and report

Explain what counts as an incident in simple terms: a suspected phishing click, lost device, unexpected encrypted files, strange payment requests, unknown account activity or accidental data exposure. Give staff one reporting route, such as a phone number and a monitored email alias, and promise that reporting quickly will never lead to blame.

Define a basic severity scale, such as minor, serious and critical, with an example of each. Severity helps the lead decide whom to wake up and which actions are needed.

Section 3: the first hour

List actions in order, because people follow lists when they are under pressure.

• Write down the time, who reported and what was seen
• Isolate affected devices from the network without powering them off where possible
• Change passwords and revoke sessions for compromised accounts from a clean device
• Preserve evidence: do not delete, wipe or reinstall until advised
• Call the IT provider and, if applicable, the insurer
• Decide who needs to be told internally, and keep the circle small at first

Section 4: communication

Decide in advance who speaks to staff, customers, the press and regulators, and who approves what is said. Prepare short holding statements for common scenarios. Honest and calm messages work best: what happened, what you know, what you are doing and when you will update.

Remember that normal channels might be compromised. Note an alternative means of contact, such as a group chat created on personal devices or a phone tree, in case email is unavailable.

Section 5: recovery and review

Describe how you restore normal operations: from clean backups, with rebuilt systems where needed, and with credentials rotated. Note who signs off that systems are safe to return. After recovery, hold a review within a couple of weeks and record what happened, what worked, what did not and what will change.

Update the plan after every real incident and every exercise. Review contacts every six months, because phone numbers and staff change more often than people expect.

Things people forget to include

A few small details turn a decent plan into a useful one. Note where the plan itself is stored, including the printed copy and who holds it. Record how to reach each person when the company phone system or email is down. List the systems in priority order for restoring, such as payments, email, customer records and then everything else, so that nobody has to decide the order under pressure.

Include any contractual or regulatory deadlines you know of, and the location of key documents such as your insurance policy, network diagrams and lists of accounts. Add the legal hold rule: do not delete emails, logs or files related to the incident. Finally, name who may authorise paying for emergency help, because delays on this point can cost days.

Practise with a twenty-minute exercise

Pick a scenario, such as a staff member reporting that they entered their password on a fake page and now sees login alerts. Gather the team, read the scenario aloud and walk through the plan. Who is called first? What is isolated? Who tells the customers? Note where people hesitate or disagree, then fix the plan. One short rehearsal a year makes a real incident far less chaotic.