Incident Response Plan for Small Business: A Template

A cybersecurity incident response plan is a short written document that says who is in charge, who to contact, and what to do in the first hour when something goes wrong: ransomware, a hijacked email account, a lost laptop. For a small business, one to two pages is enough. It needs named roles, a printed contact list, a few plain-English first steps, and your legal notification deadlines. The template below is free to copy.

This post is about preparing before anything happens. If you are dealing with an incident right now, go to what to do after a data breach, which covers the response hour by hour.

What Is an Incident Response Plan?

CISA, the federal cybersecurity agency, describes it as “a written document, formally approved by the senior leadership team, that helps your organization before, during, and after a confirmed or suspected security incident.” Its job is to settle the decisions that are hard to make under stress: who leads, who may shut a system down, who talks to customers, and which outside help you bring in.

It is a different document from a disaster recovery plan. Disaster recovery is about restoring systems after any outage, such as a failed server or a flood. Incident response is about a security event, where you also have to stop an intruder, preserve evidence, and possibly notify people.

What Counts as an Incident?

Your plan should list the events that trigger it, so staff do not have to guess. For most small offices that list is:

• Ransomware or other malware on any computer
• A sign-in to email or a cloud account that nobody recognizes
• Business email compromise: a mailbox used to send fake invoices or change payment details
• A staff member who entered a password on a fake sign-in page
• Customer or employee records sent, shared, or copied somewhere they should not be
• A lost or stolen laptop or phone that holds business data

A slow computer or a jammed printer is a support request, not an incident. When in doubt, staff should report it anyway. CISA’s advice is to “be gracious when people report false alarms.”

How the Plan Maps to NIST SP 800-61

NIST SP 800-61 is the federal government’s incident response guide, and most templates you will find are based on it. The older revision used four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.

NIST replaced it in April 2025 with SP 800-61 Revision 3, which reorganizes the same work around the six functions of the NIST Cybersecurity Framework 2.0. NIST says organizations may keep using whichever model suits them, so a four-phase template is still fine. The mapping looks like this:

Older four-phase model	CSF 2.0 functions in Revision 3	What it means for a small office
Preparation	Govern, Identify, Protect	Write the plan, assign roles, know what data you hold, keep backups and MFA in place
Detection and analysis	Detect	Staff know how to report; someone reviews security alerts
Containment, eradication, and recovery	Respond, Recover	Isolate, preserve evidence, remove the intruder, restore from clean backups
Post-incident activity	Identify (improvement)	A blameless review, then update the plan

If you want the wider framework in plain language, see our guide to the NIST Cybersecurity Framework for small business.

Who Does What: Three Roles

CISA’s guidance names three roles. In a small office the same individual may hold two of them, but write a name and a backup next to each.

Role	What they do	Typical person
Incident manager	Leads the response, keeps the timeline, makes decisions, delegates. CISA notes this person does no technical work.	Owner or office manager
Technical lead	Isolates systems, preserves logs, brings in outside specialists	Your IT provider or internal IT person
Communications lead	Handles messages to staff, customers, and any press, using wording your attorney has approved	Owner or a senior manager

Also decide in advance who can authorize spending and who can approve shutting down a system that the business depends on. Settle both now so that nobody has to decide them in the middle of an incident.

A One to Two Page Plan You Can Copy

Replace the brackets, print it, and hand a copy to everyone named in it.

INCIDENT RESPONSE PLAN: [Business name]
Approved by: [Owner]          Last reviewed: [Date]

1. WHEN TO USE THIS PLAN
Ransomware or malware, an unrecognized sign-in, a hijacked mailbox,
a password entered on a fake page, records sent or copied where they
should not be, a lost or stolen device.

2. HOW STAFF REPORT
Tell [incident manager] right away, in person or by phone.
Do not use email if email may be affected. No blame for false alarms.

3. ROLES
Incident manager: [Name, mobile]      Backup: [Name, mobile]
Technical lead:   [Name, mobile]      Backup: [Name, mobile]
Communications:   [Name, mobile]

4. CONTACTS (keep current)
IT provider: [Name, number, backup contact]
Cyber insurance: [Carrier, policy number, claims or breach hotline]
Attorney: [Name, number]
Bank fraud department: [Number]
Payment processor: [Number]
Microsoft 365 or Google Workspace admin: [Name]
Key vendors holding our data: [Practice software, payroll, etc.]
Law enforcement: local police [number]; FBI reports at ic3.gov

5. FIRST HOUR
a. Disconnect the affected computer from the network
   (unplug the cable, turn off Wi-Fi). Leave it powered on.
b. Do not wipe, reinstall, or delete anything.
c. Start a written log: time, who, what was seen, what was done.
d. Contact the technical lead and the insurance hotline.
e. From a clean device: reset the affected passwords, sign the
   account out of all sessions, confirm MFA is on.
f. If money was sent: contact the bank's fraud department now.

6. SEVERITY
Low: one device or account, no sensitive data. Technical lead handles.
High: sensitive data, money, or more than one system.
      Incident manager brings in the attorney and the insurer.

7. NOTIFICATION CHECK (with the attorney)
What data was involved? Whose? Was it encrypted?
California residents: notice within 30 calendar days of discovery.
More than 500 California residents: sample notice to the Attorney
General within 15 calendar days of notifying them.
Patient data: HIPAA breach rules. Card data: contact the processor.

8. AFTERWARD
Blameless review within two weeks. Update this plan.
Tell staff what changed.

What to Know About the Notification Section

The deadlines in section 7 come from California’s breach notification law, Civil Code section 1798.82, as amended effective January 1, 2026. A business must notify affected California residents within 30 calendar days of discovering the breach, and must send a sample notice to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are affected. Law enforcement can ask you to delay if notice would impede an investigation.

Other rules may apply on top. Medical and dental practices fall under the HIPAA Breach Notification Rule. Tax preparers, mortgage brokers, and other firms covered by the FTC Safeguards Rule must report certain incidents to the FTC within 30 days. This is general information, not legal advice. CISA specifically recommends reviewing your plan with an attorney, who may prefer a different template.

How to Build Yours in an Afternoon

1. List what you hold. Email, accounting, customer or patient records, payroll, card payments. This tells you which laws apply and what an intruder would want. (About 30 minutes.)
2. Fill in the contact list. The insurance hotline and policy number matter most. Ask your broker now whether the policy requires you to use the carrier’s approved responders. See what cyber insurance applications ask for.
3. Confirm who holds admin access. Make sure at least two people can reach the Microsoft 365 or Google Workspace admin console, each with their own account and MFA.
4. Check your backups. A plan that says “restore from backup” is only as good as the last restore test. Our business data backup guide covers what to test.
5. Print it. CISA’s reason is practical: during an incident, your email, chat, and file storage may be down or inaccessible. Keep a copy at the office and one at home.
6. Run a tabletop exercise. Spend 30 to 45 minutes once a year talking through one scenario, for example “the bookkeeper’s mailbox sent 200 fake invoices overnight.” Each person says what they would do. Gaps show up quickly. CISA publishes tabletop exercise packages with ready-made scenarios, including ransomware and phishing, that you can adapt.
7. Review it on a schedule. CISA suggests quarterly. At minimum, update it when you change IT providers, insurers, email platforms, or key staff.

Common Mistakes

• The plan lives only on the systems it protects. If it is in SharePoint and SharePoint is locked, nobody can read it.
• Job titles instead of names and mobile numbers. People need a number they can dial from a personal phone.
• Nobody knows the insurance process. Read the policy’s conditions on reporting an incident and choosing responders in advance, and write the steps into the plan.
• Wiping the computer first. Reinstalling feels productive, but it destroys the evidence needed to work out what was accessed, which is the question that decides whether you must notify anyone.
• No backup person for each role. Incidents do not wait for someone to return from vacation.

When a Short Plan Is Not Enough

A two-page plan suits an office of roughly 5 to 50 people. You will need more if a regulator or contract requires specific content. The HIPAA Security Rule, the FTC Safeguards Rule, and PCI DSS each expect a documented incident response process, and some customer contracts set their own notification deadlines that are shorter than state law. In those cases, keep the two-page version as the front sheet and attach the detail behind it.

Common Questions

How long should a small business incident response plan be?

One to two pages for the core plan. It should fit on paper that someone can read in two minutes under stress: triggers, roles, contacts, first-hour steps, and notification deadlines. Longer procedures, such as how to restore a specific server, belong in separate documents that the technical lead maintains.

Who should be the incident manager?

Someone with authority to make decisions and spend money, usually the owner or office manager. CISA’s guidance says the incident manager runs communication and delegates tasks but does not perform technical work. That separation matters, because the person fixing the problem should not also be fielding questions from staff and customers.

Does cyber insurance require an incident response plan?

Many applications ask. For example, the Travelers CyberRisk short form application asks whether the applicant has “an incident response plan to respond to a network intrusion.” A written plan lets you answer yes accurately. An inaccurate answer on an application can cause problems at claim time.

How often should we test the plan?

Run a tabletop exercise at least once a year, and again after any major change such as a new email platform or IT provider. Review the contact list more often. CISA recommends a quarterly review, since phone numbers, policy numbers, and staff change faster than the rest of the plan.

How Coastal Growth Co. Can Help

We can help you fill in this template for your office: confirming who holds admin access, documenting where your data lives, checking that backups restore, and running a first tabletop exercise with your staff. It works well as a one-time project or as part of managed IT support. Scope and price are agreed before any paid work starts. Reach us through the contact page.