Incident Response Plan for Small Businesses (Template)

When a cyber incident hits, the first hours decide how much it costs you. An incident response plan means nobody has to invent the next step under pressure. This playbook gives small businesses a simple template covering roles, contacts, the six phases of response and the reporting duties in the UK and US.

An incident is anything that threatens your systems or data: a ransomware attack, a compromised email account, a lost laptop, a fraudulent payment, a staff member who clicked a bad link or a supplier who tells you they have been breached. Without a plan, the response depends on whoever happens to notice and what they think to do. That is when evidence gets destroyed, deadlines get missed and small problems grow.

A plan does not need to be long or technical. It needs to answer a few questions before you need the answers: who is in charge, who do we call, what do we do first and what must we report. This playbook walks you through each part and ends with a template you can copy into a document today. It goes deeper than the incident steps in our cybersecurity checklist, and pairs well with a tested backup plan and cyber insurance if you have it.

The six phases of incident response

Most incident response frameworks follow the same basic cycle. For a small business, think of it as six phases.

1. Prepare: agree roles, collect contacts, keep backups and know your insurer's hotline before anything happens.
2. Detect: notice that something is wrong, from an alert, a staff report, a customer call or a strange bank transaction, and decide whether it is an incident.
3. Contain: stop it spreading. Isolate affected devices from the network, disable compromised accounts and pause affected payments.
4. Eradicate: remove the cause, such as malware, unauthorized accounts, forwarding rules or the weakness that let the attacker in.
5. Recover: restore systems and data from clean backups, check they work and return to normal operations carefully.
6. Lessons learned: review what happened, what worked and what to change, then update the plan.

Phase 1 in detail: prepare before anything happens

Preparation is the phase that makes all the others faster. Most of the template below is preparation work.

Assign roles

In a small business, one person may hold several roles, but every role should have a named person and a backup.

Collect contacts you can reach without email

If your email is compromised or your systems are encrypted, you cannot rely on them to find phone numbers. Keep a printed contact sheet and a copy on a personal phone.

• IT provider, including out-of-hours number
• Cyber insurer's incident hotline and policy number
• Bank fraud line
• Key suppliers who host your systems, such as website, email and accounting providers
• Legal adviser, if you have one
• Police and reporting contacts (see the reporting section below)

Know where your backups are

Record what is backed up, where, how to restore it and who has the access. A backup nobody knows how to restore is not much use during an incident.

Phases 2 to 6: what to do when it happens

Detect and assess

Make it easy for anyone to raise the alarm. Staff should know who to call and that they will not be blamed for reporting something, even if it turns out to be nothing. The incident lead then asks: what has happened, which systems or data are affected, is it still happening and is personal data involved?

Start the log immediately

Write down the time and details of every observation, decision and call. Include who did what and when. This log helps your IT provider and insurer, supports any report you make and is essential for meeting deadlines such as the ICO's 72-hour window.

Contain

• Disconnect affected devices from the network and Wi-Fi, without wiping or powering them off before taking advice.
• Disable or reset compromised accounts, and sign out all sessions.
• Change passwords from a clean device, starting with email, admin and banking accounts.
• Ask your bank to pause or recall suspicious payments.

Eradicate and recover

Your technical contact removes the cause and checks for anything the attacker left behind, such as new accounts or mailbox forwarding rules. Only then restore from clean backups. Restoring before the way in is closed risks a repeat incident.

Lessons learned

Within a couple of weeks, hold a short review. What was the cause, how was it spotted, what slowed the response and what one or two changes would help most? Update the plan with the answers.

Reporting duties in the UK and US

Reporting helps law enforcement and may be a legal duty if personal data is involved. This section is general information, not legal advice. Rules and reporting routes change, so check current guidance from GOV.UK, the ICO, the FTC or a qualified adviser.

UK

• Crime and fraud: in England, Wales and Northern Ireland, report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. Report Fraud replaced Action Fraud on 4 December 2025. In Scotland, call Police Scotland on 101.
• Phishing: forward suspicious emails to [email protected] and scam texts to 7726, which is free.
• Personal data breaches: under UK GDPR, report to the ICO within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms. Tell affected individuals without undue delay if there is a high risk. Record all breaches, even ones you do not report. The ICO helpline is 0303 123 1113, and there is an online report form on ico.org.uk.

US

• Cyber crime and BEC: file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov.
• Scams and identity theft: report to the FTC at ReportFraud.ftc.gov.
• Wire transfers: contact your bank immediately to try to recall the payment.
• Data breaches: state data breach notification laws vary, so check the rules in each state where affected people live.

In the EU, the same 72-hour rule applies for personal data breaches, reported to your national supervisory authority.

Your incident response plan template

Copy these headings into a document, fill them in and print a copy. Keep it to a few pages so people actually use it.

1. Purpose and scope: one sentence on what counts as an incident for your business.
2. Roles: names, backups and phone numbers for each role in the table above.
3. Contact sheet: IT provider, insurer hotline, bank fraud line, key suppliers, legal adviser and reporting contacts.
4. How to raise the alarm: who staff should call, and a reminder not to wipe or switch off affected devices.
5. First-hour checklist: start the log, isolate devices, call IT and insurer, secure email from a clean device, contact the bank if payments are involved.
6. Systems and backups list: key systems, who supports them, where backups are and how to restore.
7. Reporting duties: police or fraud reporting, ICO or state breach rules, and customer notification steps.
8. Communication templates: short holding messages for staff, customers and suppliers.
9. Review: date of the last test and the next planned review.

Test and maintain the plan

A plan that has never been tested usually has gaps. A tabletop exercise is a simple way to find them: gather the people in the plan, describe a realistic scenario and talk through what each person would do, step by step. Rotate scenarios each time, such as a lost laptop, a compromised mailbox, a ransomware message on screen or a supplier breach.

• Run a tabletop exercise at least once a year.
• Update contacts whenever staff, suppliers or insurers change.
• Review the plan after every real incident.
• Use free guidance from the NCSC in the UK and CISA in the US to build realistic scenarios.

Frequently asked questions

The bottom line

An incident response plan turns a frightening moment into a list of steps. Name your roles, print your contacts, follow the six phases and know your reporting duties before anything goes wrong. Then test the plan once a year, so when a real incident arrives your team already knows what to do in the first hour.