Small Business Cyber Incident Response Plan: What to Do Before, During, and After an Attack

A cyber incident is a bad time to decide who should call the bank, disable an account, contact the IT provider, restore a backup, or communicate with customers. Small businesses need a simple incident response plan before something goes wrong.

NIST current incident response guidance treats response as part of ongoing cybersecurity risk management, not as an isolated emergency activity. For a small business, the plan does not need to be enormous. It needs to identify critical contacts, decision makers, first actions, recovery priorities, and the information responders will need.

What Is a Cyber Incident Response Plan?

An incident response plan is a documented process for handling cybersecurity events that could affect business systems, accounts, data, money, or operations. It should help the company move from detection to containment, response, recovery, and improvement without relying on memory during a stressful event.

1. Decide Who Is in Charge Before an Incident

Every important response task should have an owner. In a very small business, one person may coordinate several roles, while technical work may be handled by an MSP, MSSP, incident-response firm, cloud provider, or other specialist.

• Business decision maker or owner.
• Internal IT or external IT/security provider.
• Cyber insurance contact and breach-response hotline when applicable.
• Bank or payment-provider fraud contact.
• Legal or privacy counsel when needed.
• Communications or customer-contact owner.
• Key software and cloud providers.
• Law-enforcement or reporting contacts appropriate to the incident.

Store an offline or otherwise independently accessible copy of the contact list. If email or cloud storage is unavailable, a response plan stored only inside the affected environment may be difficult to use.

2. Identify What Must Be Restored First

List the systems and data the business cannot operate without. Typical priorities include email, identity systems, accounting, payroll, customer records, operational applications, shared files, websites, and critical cloud services.

Define recovery priorities before an outage. Our Small Business Backup Strategy explains recovery objectives, backup separation, and restore testing.

3. Make Reporting Suspicious Activity Easy

Employees should know where to report a suspicious login, unexpected MFA prompt, phishing message, lost device, ransomware note, fraudulent payment request, or other unusual event. Fast reporting can materially affect how quickly the business contains an incident.

4. Contain the Incident

The appropriate containment action depends on the incident. A compromised account may need to be disabled or have active sessions revoked. An infected endpoint may need to be isolated from the network. A stolen device may need business access removed. A fraudulent payment may require immediate contact with the financial institution.

For ransomware, CISA recommends determining which systems are affected and immediately isolating impacted systems, while prioritizing systems essential to daily operations. When qualified responders are available, coordinate with them so containment does not unnecessarily destroy useful evidence.

5. Protect Accounts During an Identity Incident

• Disable or secure compromised accounts.
• Revoke suspicious sessions and tokens where supported.
• Reset affected credentials from a known-clean device.
• Review MFA methods and recovery options for unauthorized changes.
• Inspect email forwarding and mailbox rules.
• Review privileged accounts and administrator activity.
• Check whether the same credentials were reused elsewhere.

See MFA for Small Business and Password Managers for Small Business for preventive controls.

6. Act Quickly After Suspected Payment Fraud

If money was sent because of a compromised email account or fraudulent payment instruction, contact the financial institution immediately using a trusted contact method and follow its fraud-recovery procedures. Preserve messages, invoices, account details, timestamps, and other relevant records.

Our Business Email Compromise guide explains preventive payment-verification controls.

7. Communicate Through a Defined Process

An incident may require communication with employees, customers, vendors, insurers, law enforcement, regulators, or other parties. The exact obligations depend on the event, data involved, contracts, industry, insurance policy, and jurisdiction. Decide in advance who can authorize external communications and preserve a record of important decisions and notifications.

8. Understand Your Cyber Insurance Procedure

If the business has cyber insurance, keep the current policy and incident contact process accessible. Policies may include notification requirements, approved service providers, consent provisions, or procedures that can affect coverage. Review our Cyber Insurance Requirements for Small Businesses guide as part of preparation.

9. Recover From Known-Good Systems and Backups

Recovery is more than turning systems back on. Determine what was affected, address the cause where possible, verify backup integrity, restore systems in business-priority order, and monitor for signs that the threat remains. NIST small-business guidance emphasizes verifying the integrity of backups and other assets before returning them to use.

10. Record What Happened

Maintain a basic incident log with dates, times, affected systems, people involved, actions taken, communications, financial impact, and important evidence. This can help technical responders, insurers, legal advisers, management, and later improvement work.

11. Review the Incident and Fix the Weaknesses

After operations stabilize, review what allowed the incident to happen and what made the response easier or harder. Improvements may include MFA, access changes, better logging, stronger backups, new payment procedures, endpoint controls, employee training, vendor changes, or clearer responsibilities. CISA notes that logging and monitoring can help teams detect suspicious activity and respond faster.

Small Business Incident Response Checklist

• Incident coordinator and backup decision maker named.
• IT/security provider emergency contact documented.
• Bank and payment-provider fraud contacts documented.
• Cyber insurer contact and policy procedure accessible.
• Critical systems and recovery order documented.
• Employee reporting method defined.
• Account-disable and session-revocation procedures understood.
• Device-isolation process understood.
• Backups separated and restoration tested.
• Alternative communications method identified.
• External notification decisions assigned.
• Incident log template available.
• Plan reviewed after significant business or technology changes.
• Plan exercised periodically with a simple scenario.

A Simple Incident Scenario to Practice

Imagine an employee reports that their business email account appears compromised and a supplier says it received unusual payment instructions. Walk through the response without touching production systems: Who receives the report? Who disables the account? Who checks mailbox rules and sessions? Who contacts the supplier and bank? Who determines whether other accounts were affected? Who contacts the insurer? How would the company communicate if email became unavailable?

A short tabletop exercise can expose missing phone numbers, unclear responsibilities, unavailable backups, or assumptions about an IT provider before a real emergency exposes them.

Frequently Asked Questions

Does a small business really need a written incident response plan?

Yes. The plan can be concise, but documenting contacts, responsibilities, first actions, and recovery priorities reduces improvisation during an incident. NIST 2026 small-business draft guidance explicitly includes creating a cybersecurity incident response plan as an action for very small businesses.

Who should handle an incident if we have no security team?

Define external support before an incident. Depending on the business, that may include an MSP or MSSP, incident-response provider, insurer breach-response team, legal counsel, cloud provider, bank, and appropriate law-enforcement contacts. Internal management still needs a person who can coordinate business decisions.

Should we pay a ransomware demand?

Ransomware incidents involve technical, legal, financial, insurance, sanctions, and operational considerations. Do not make the decision from a generic website checklist. Engage qualified incident-response, legal, insurance, and other appropriate professionals and authorities for the specific event.

Prepare the Decisions Before the Emergency

A useful small-business incident response plan is not measured by page count. It is measured by whether the right people can quickly answer: what happened, what should we isolate, who needs to know, what must be restored first, and who has authority to make the next decision.

Continue with our Business Protection hub, review the Small Business Cybersecurity Checklist, or explore Tools & Checklists.

Sources and methodology: This guide was informed by NIST SP 800-61 Rev. 3, NIST Small Business Cybersecurity guidance, and CISA small-business, logging, and StopRansomware guidance. CyberCostLab translates those resources into a practical planning framework for small organizations.

Editorial note: Incident-response, breach-notification, legal, regulatory, insurance, contractual, and law-enforcement requirements vary by incident and jurisdiction. This article is general educational information and is not a substitute for incident-specific professional advice.