How to write an incident response plan for a small business (without a security team)
An incident response plan is the document you reach for on the worst day of the year: when a laptop is stolen, an employee wires money to a fake supplier, or files suddenly won't open because of ransomware. Big companies have security teams and 80-page runbooks. A small business needs something shorter: a plan the owner, office manager and IT provider can follow under stress.
NIST's current incident response guidance, NIST SP 800-61 Rev. 3 (published April 2025), frames incident response as part of everyday risk management rather than a stand-alone binder: preparing beforehand, detecting and responding during, and recovering and improving afterward. Here is how to apply that thinking at small-business scale.
Step 1: Define what counts as an incident
If people don't know what to report, they won't report it. Give plain examples: a suspicious email someone clicked, a lost phone or laptop, a ransom note, an unexpected password-reset alert, money sent to a changed bank account, a customer saying they received a strange invoice from you. Make it clear that reporting early is never a mistake.
Step 2: Name the people and their jobs
For a small business, three or four roles are usually enough:
- Incident lead: makes decisions and keeps the timeline (often the owner or operations manager).
- Technical lead: your internal IT person or managed service provider.
- Communications: who talks to staff, customers and, if needed, the press.
- Finance: for payment fraud, calls the bank immediately.
Name a backup for each. Incidents don't wait for vacations.
Step 3: Build the contact sheet now
This is the single most valuable page in the plan. Print it, because if your email or file server is down you won't be able to look it up. Include:
- Your IT provider's emergency number.
- Your cyber-insurance carrier's claims or breach hotline and your policy number. Many policies expect prompt notice and may require you to use their approved vendors, so check your wording.
- Your bank's fraud line.
- Legal counsel (or the breach counsel your insurer provides).
- Law enforcement reporting: in the US, the FBI's Internet Crime Complaint Center at ic3.gov.
Step 4: Agree on severity levels
Not every event needs everyone on a call at 2 a.m. A simple three-level scale works: Low (one user, no data or money at risk), Medium (sensitive data may be exposed or several users affected), High (operations stopped, money lost, ransomware, or customer data likely exposed). For each level, write who must be told and how quickly.
Step 5: Write the response steps
Keep each phase to a handful of actions:
- Detect and report: who to call, what to write down (time, what you saw, what you clicked).
- Contain: disconnect affected devices from the network (don't power them off without your IT provider's advice, as that can destroy evidence), reset compromised passwords, revoke sessions.
- Notify: call your insurer before engaging outside vendors if your policy requires it; involve counsel if personal data may be involved.
- Eradicate and recover: remove the cause, restore from known-good backups, and watch for re-entry.
- Learn: hold a short review and update the plan.
Step 6: Add one-page playbooks for your two most likely incidents
Business email compromise (BEC). In the FBI IC3 2025 Internet Crime Report, business email compromise accounted for about $3.05 billion in reported losses, second only to investment fraud. Your playbook: call the bank's fraud line immediately to try to recall the payment, reset the mailbox password and revoke sessions, check for malicious forwarding rules, file a report at ic3.gov, and warn customers or suppliers who may receive fake messages.
Ransomware. Isolate affected machines, preserve the ransom note, contact your IT provider and insurer, check that backups are intact and offline, and don't negotiate on your own. The CISA #StopRansomware Guide includes a detailed response checklist worth attaching to your plan.
Step 7: Keep a simple incident log
A table with date/time, who, what happened and what was done. Insurers, lawyers and your future self will all want this timeline.
Step 8: Test it once a year
A 45-minute tabletop exercise is enough: gather the people named in the plan, read out a scenario ("Accounts payable just paid a supplier's new bank account, and the supplier says they never changed it"), and walk through what each person would do. Note what was unclear and fix it. Many cyber-insurance applications ask whether your plan has been tested in the last year.
Shortcut
Our Incident Response Plan template already contains these sections: roles, an external contact sheet, severity levels, response phases, ransomware and business-email-compromise quick actions, an incident log and a testing section. It's an editable Word document with [BRACKETED] fields and guidance notes. It is also part of the Starter Kit.