Building a Cyber Security Incident Response Plan (Without Overcomplicating It)

"Incident response plan" sounds like something only a large organisation with a dedicated security team needs. In practice, the useful version of one for a small business is much simpler than that phrase suggests — and the businesses that have even a basic version tend to recover faster and with far less chaos than those working it out from scratch in the moment.

What it actually needs to cover

At its core, a usable plan answers a handful of plain questions: who needs to be told immediately if something looks wrong, who has the authority to make a call like disconnecting a system from the network, who contacts customers or suppliers if needed, and who's responsible for actually getting systems back up. Written down clearly, in plain language, this is often no more than one or two pages.

Why "figuring it out at the time" doesn't work

The problem with relying on common sense in the moment is that incidents are, by nature, stressful and confusing, often discovered outside normal working hours, and frequently involve some disagreement about how serious the situation actually is. Without a plan, those first critical minutes or hours are often spent debating who should be doing what, rather than actually doing it.

The first step matters more than people expect

A genuinely useful early instruction in most plans is simple: if a device looks compromised, disconnect it from the network (unplug the cable, turn off Wi-Fi) rather than switching it off completely. Shutting a device down entirely can sometimes destroy evidence that would help work out what actually happened and how far it spread, whereas disconnecting it from the network stops it spreading further while keeping that information intact.

Know who to call before you need to

Have the key numbers and contacts written down somewhere accessible that doesn't depend on the compromised systems themselves — your IT support provider, your insurer if you have cyber insurance (and a note of what they need from you to make a claim), and, depending on what's affected, the Information Commissioner's Office if personal data may be involved. Trying to find these details for the first time while already dealing with an active incident wastes valuable time.

Test it before you actually need it

A plan that's never been talked through tends to reveal its gaps exactly when you can least afford them. Running through a simple "what would we actually do if X happened" conversation once or twice a year, even informally, tends to surface problems — an outdated contact, an unclear decision-maker — while there's no real pressure, rather than during a genuine incident.

If you don't currently have anything written down for this, or want help putting together something realistic for how your business actually operates, our cyber security page covers how we can help, or get in touch.