Most small businesses do not need a formal security operations center to survive a cyber incident. They need a plan that answers three questions: who calls whom, what gets shut down first, and how the business keeps running while the problem is fixed. A missing laptop, a compromised email account, or a ransomware pop-up can turn into a week of chaos without a written response. The good news is that a useful plan can fit in a few pages and be built in an afternoon, then improved over time.
Define what counts as an incident
Not every suspicious email is an incident. If you treat every phishing attempt as a crisis, your team will burn out. Write down the events that trigger the plan:
- Unauthorized access to email, cloud storage, or a line-of-business app
- Malware or ransomware on a work device
- Lost or stolen laptop, phone, or external drive
- Accidental exposure of customer or employee data
- Compromised vendor, payment, or banking account
- Repeated MFA prompts or impossible travel alerts
Then add a simple severity scale. It does not need to be perfect. It needs to be consistent.
Use four levels
- Low: contained to one device, no data accessed, no customer impact.
- Medium: one account compromised, limited data exposure, business can continue.
- High: multiple systems or sensitive data involved, operations disrupted.
- Critical: ransomware, major data breach, or safety and legal risk.
Severity drives who gets woken up and how fast you respond. A medium email compromise and a critical ransomware event should not follow the same path.
Assign roles before you need them
Small teams wear many hats. That is fine, but each role needs a name and a backup. If the owner is also the incident lead, write down who takes over when they are offline.
- Incident Lead: declares severity, coordinates the response, makes final calls.
- Technical Lead: investigates, isolates systems, works with your IT provider.
- Communications Lead: drafts internal updates and customer messages.
- Legal or Compliance Contact: outside counsel or advisor for breach notification duties.
- Scribe: keeps a timeline of actions, decisions, and evidence.
- Backup for every role.
Keep the contact list offline. If email is compromised, you cannot rely on email to coordinate. Print it, store it in a safe, and save it on a phone. Add your IT provider, cyber insurer, legal counsel, and bank. Breach notification rules vary by location and industry. This information is not legal advice; ask qualified counsel when personal data may be involved.
Build detection that fits a small team
Detection does not require a security team watching screens. It requires a few reliable signals and a clear way for employees to report them.
- Turn on MFA for email, cloud storage, banking, and admin accounts.
- Enable login alerts and unusual activity notifications.
- Centralize security alerts into one mailbox or channel.
- Give staff a simple way to report concerns, such as a dedicated email or chat channel.
- Review backup failures and antivirus alerts weekly, not monthly.
Train people to report mistakes quickly. The employee who clicks a phishing link is not the problem; the employee who hides it is. Make reporting blame-free. For example, an employee gets a push notification they did not request. The plan says: report it, reset the password, revoke active sessions, check mailbox rules, and tell the incident lead. That takes ten minutes and can stop a full takeover.
Contain first, then investigate
When something is confirmed, your first goal is to stop the spread. Investigation matters, but a fast containment step often saves the most damage. The exact technical steps depend on your tools, so agree on them with your IT provider in advance.
- Declare the incident. The incident lead sets severity and starts a timeline.
- Isolate affected systems. Disconnect the device from Wi-Fi and Ethernet, or disable the account. For cloud accounts, revoke sessions and tokens.
- Preserve evidence. Save emails, screenshots, logs, and notes before wiping anything. If you need forensics, ask before deleting.
- Reset credentials. Change passwords for affected accounts and any shared passwords. Turn on MFA if it was missing.
- Assess scope. Which data, systems, and people are affected? Check backups and logs.
- Escalate. Bring in your IT provider, forensics firm, legal counsel, or insurer if severity is high.
Write down who has authority to shut down a system. In a small business, that is often one or two people. Make sure everyone else knows not to reboot, wipe, or pay anything until the lead says so. Ransomware demands should go to the incident lead, legal counsel, and law enforcement; do not negotiate alone.
Communicate without making it worse
Silence creates rumor. Bad communication creates liability. Aim for short, factual updates.
Internal updates
- Use one channel: a group chat, conference bridge, or SMS tree.
- Share what is known, what is not known, and the next update time.
- Remind staff not to discuss the incident publicly or on social media.
External updates
Designate one spokesperson. Everyone else routes questions to them. Prepare a holding statement you can adapt. For example:
We are investigating a security incident that may have affected some systems. We have taken steps to contain it and are working with specialists. We will share more information as it becomes available.
Notify customers, partners, and regulators only after legal counsel confirms requirements and timing. Never guess at the number of affected people or the cause. Say what you know, and correct the record later if facts change.
Recover, verify, and review
Recovery is not just restoring files. It is proving the threat is gone and the business can operate safely.
- Restore from backups that were made before the incident. Test a small restore first.
- Rebuild compromised devices from trusted images rather than cleaning them in place when possible.
- Reset passwords again after containment if credentials may have been exposed.
- Patch the entry point and close the gap.
- Monitor closely for at least a few days after recovery.
Exit criteria
Define what must be true before you declare the incident closed: affected systems are clean, backups are intact, monitoring is active, and the root cause is understood. Then hold a 30-minute review. Ask three questions: What worked? What failed? What will we change? Update the plan while details are fresh.
Keep the plan usable
A plan that lives in a forgotten folder is not a plan. Keep it to a few pages, review it quarterly, and update it after every incident, staff change, or new tool. Store a printed copy somewhere accessible if networks are down. Run a simple tabletop exercise: pick a scenario, such as a lost laptop with customer data, and walk through the first hour. You will find gaps in minutes.
Your first hour checklist
Print this list and keep it with your contact sheet.
- Confirm the incident and assign the incident lead.
- Isolate the affected account or device without destroying evidence.
- Start a timeline. Record times, people, and actions.
- Notify the core team through a non-email channel.
- Contact your IT provider, legal counsel, or insurer if severity is medium or higher.
- Preserve logs, emails, and screenshots.
- Set the next update time and stick to it.
Small businesses cannot prevent every incident. They can decide ahead of time how they will respond. A clear plan turns a panic into a process, and a process protects your customers, your team, and your ability to keep the doors open.
Photo: Christina Morillo / Pexels
