A one-page incident response plan for a small company

When an incident happens — ransomware, a hacked mailbox, a leaked database — people lose time asking the same questions: who decides, who do we call, can we turn the servers off? A short written plan answers them in advance.

What to put on the page

1. Contacts: IT team or provider (with a 24/7 number), management, legal counsel, bank, insurance, and who speaks to clients and media.
2. First actions: isolate affected devices from the network, do not switch them off, protect backups, write down times and observations.
3. Decision rights: who may disconnect the internet, stop production systems or engage outside experts — and the deputy for each.
4. Critical systems list: what must be restored first (for example 1C, email, file server) and where the backups are.
5. Communication: how employees are informed if email is down (phone tree, messenger group), and templates for clients and partners.
6. Obligations: when and to whom incidents involving personal data must be reported under applicable law and contracts.

Keep it alive

• Print it and keep copies offline — during an attack the file server may be encrypted.
• Review it twice a year and after every change of key people.
• Run a 1-hour tabletop exercise: walk through a scenario and see what is missing.

The plan does not have to be perfect. It has to exist, be known and be reachable when the systems are not.

Need help with this? Contact CySec for a free consultation.

All articles