Cybersecurity · Planning
A section-by-section outline for a small-business incident response plan, a first-hour checklist and a simple way to test it before you need it.
Nine sections, plain language
First-hour checklist
Test it with a tabletop
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
A small-business incident response plan is a short written document that says who decides, who does what and who gets called when something goes wrong: ransomware, a hacked email account, a lost laptop or a payment fraud. A usable template has nine parts: purpose and scope, roles and contacts, what counts as an incident, severity levels, the first-hour checklist, containment and recovery steps by incident type, communication and notification, evidence and documentation, and review and testing.
Keep it to a few pages, print a copy and test it once a year with a one-hour tabletop exercise. Below is the outline with what to write in each section.
NIST’s updated incident response guidance, SP 800-61 Revision 3 (April 2025), ties incident response to the six functions of the NIST Cybersecurity Framework 2.0 rather than treating it as a standalone procedure. The practical takeaway for a small business is that the plan is part of everyday security, not a binder on a shelf. During an incident nobody reads 40 pages. They need names, phone numbers and the next three steps.
Some businesses are also required to have one. The FTC Safeguards Rule requires a written incident response plan for most covered financial businesses (very small ones are exempt from this part), such as tax preparers and mortgage brokers, and many cyber-insurance applications ask whether you have one. Regulated businesses should confirm their specific obligations with counsel.
One paragraph. Which systems, locations and data the plan covers, and that it applies to employees and contractors. Note the date and who approved it.
The most important page. List an incident lead and a backup with authority to make decisions, such as shutting down systems or calling the insurer. Then list phone numbers, not just email, for:
Store a printed copy and a copy outside your main systems. If email is down or encrypted, the plan cannot live only in email.
Give staff plain examples so they report early: a suspicious login alert, files that will not open, a ransom note, money sent to a changed bank account, a lost device, or a customer saying they got a strange invoice from you. State one way to report, such as calling a named person, and say that reporting a mistake will not get anyone in trouble.
Three levels are enough. Low: contained to one device or account, no sensitive data. Medium: several users, or possible exposure of customer data. High: business operations stopped, ransomware, or confirmed data theft. Each level says who must be told and how fast.
This is section 5 of the plan, and it should fit on one page.
Want to know whether your recovery plan would hold up? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Section 6 holds short playbooks, half a page each. Start with these four.
Recovery depends on backups you have actually restored before. Our guide to backup and disaster recovery covers how to set recovery targets.
Section 7 lists who must be told: leadership, staff, customers, partners and, depending on your industry and state, regulators. Every U.S. state has a data breach notification law, and some industries have their own rules. HIPAA, the FTC Safeguards Rule and state laws each have their own timelines. Write in the plan that counsel decides on notifications, and keep pre-approved holding statements for staff and customers.
Section 8 covers evidence: keep logs, do not wipe affected machines until responders say so, and record every action with a time. Insurers and investigators will ask for this timeline.
Section 9 sets the review cycle. Test once a year and after any major change, such as a new IT provider or office.
A test restore of a real system is the most useful companion exercise. A plan that says “restore from backup” means little if nobody has timed a restore. Our cybersecurity services include a written recovery plan, monitored backups and tested restores, and we can sit in on your tabletop.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Purpose and scope, roles and a contact sheet, what counts as an incident, severity levels, a first-hour checklist, playbooks for common incidents, communication and notification steps, evidence handling and a schedule for review and testing.
Short enough to use under pressure. For a 25 to 100 person business, a few pages plus one-page playbooks for common incidents is usually enough.
Some are. The FTC Safeguards Rule requires one for most covered financial businesses, and insurers often ask about it. This is general information; confirm your obligations with counsel.
At least once a year and after major changes. A one-hour tabletop exercise using a free CISA scenario is a practical starting point.
The incident lead named in your plan, as early as possible and before hiring outside responders, because many policies require approved vendors.
