An Incident Response Plan Your Small Business Will Actually Use

Ask a business owner whether they have an incident response plan and the answer is usually one of two things. Either "we'd call our IT person," which is a phone number rather than a plan, or a vague nod toward a binder that was assembled for an insurance application and has not been opened since. Both collapse under the same scenario: it is 7 a.m. on a Monday, nothing will open, and the whole staff is looking at you. No one reads a binder in that moment, and no one improvises well either.

A third approach works, and it is the one our small business cybersecurity guide recommends: a plan short enough to use under pressure, one page settling five questions, kept honest by a two-hour exercise once a year. This article turns that recommendation into something you can finish this week. It covers what each of the five answers must contain, a fill-in template, the tabletop that tests it, and how the plan has to line up with your insurance policy and your industry's notification rules.

One idea underpins all of it. An incident response plan is not a technical document. It is a set of decisions, made ahead of time by people who are calm, so that people who are stressed do not have to make them badly at 7 a.m.

The opening minutes of an incident disappear into a question nobody answered on paper: who is allowed to act? Someone needs the authority to take systems offline, including the ones that make money, in the middle of the business day, and to approve emergency spending without calling a meeting.

Write that person's name down. Then name a deputy who holds the same authority, because incidents have a well-known habit of arriving during vacations, overnight flights and dead phone batteries. The lead does not have to be technical. They are not doing forensics; they are making the decisions the technical people need someone to make. In most small companies that is the owner, a partner or the head of operations.

Put both names and both cell numbers on the page, followed by one sentence: "This person may disconnect any system and spend whatever is necessary." The twenty minutes a team loses waiting for permission while ransomware spreads are the costliest twenty minutes of the year.

People under stress call whoever comes to mind first, in whatever order it occurs to them. The plan swaps that for a written sequence:

1. Your IT provider, for containment. They begin isolating systems and sizing up the damage while everything else proceeds in parallel.
2. Your cyber insurer's breach hotline, sooner than feels natural. This is the step businesses most often get wrong. Many policies require you to notify the carrier before you approve outside spending, and hiring vendors the carrier has not approved can put coverage at risk. The hotline also brings help: carriers keep approved incident response firms and breach lawyers who handle these cases every week. Making the insurer your second call instead of your fifth is a policy-compliance matter with real money behind it.
3. Counsel, often provided through the policy. Legal review matters before anyone says anything outside the company, because improvised breach statements create liability that outlives the incident.
4. The owner of the notification clock. In a regulated industry, someone has to own the deadline math from the first hour: HIPAA's breach timeline for medical practices, the FTC Safeguards Rule reporting window for covered financial businesses, and state breach notification laws for everyone. Name the person who starts that clock and keeps track of it.

Write the real phone numbers beside each line, and put the policy number and hotline on the same page. Hunting for your insurer's claims number while email is down turns into a research project; reading it off the sheet takes ten seconds.

In the first hour, the urge is to work out what happened. That is the wrong job. The first hour exists to stop the spread: pull affected machines off the network by unplugging cables and shutting off Wi-Fi, and if you cannot tell where the problem ends, isolate more rather than less.

Two rules travel with containment:

• Leave machines powered on. Shutting down destroys forensic evidence held in memory. Disconnect them instead.
• Do not wipe and reinstall, however productive it feels. The forensic record answers the question your insurer, your attorney and possibly a regulator will ask: what data was taken? Without that evidence you may have to assume, and notify for, the worst-case scope. In a ransomware case this one mistake can multiply the cost of the whole event, and our ransomware guide for medical and legal practices explains why in detail.

On the page, this answer stays short: which systems the lead may isolate (all of them), the priority order if the infection is spreading, and the two prohibitions in bold.

Houston companies already understand this kind of planning, because it is hurricane preparation aimed at a different disaster. When a storm knocks out power, nobody invents emergency operations on the spot; they follow the plan written in good weather. A cyber incident deserves the same treatment: a written emergency mode for running the business with no systems at all.

Settle these questions in advance, team by team. How do we take orders or see patients on paper? Who answers the phones, and how do we triage calls, if the system that routes them is offline? What do we tell customers about timing? Which tasks are truly impossible without systems, and which are only slower? A medical practice's version covers paper intake and rescheduling. A distributor's covers phone orders and handwritten pick tickets. A professional firm's covers getting to offline copies of client files.

This is also where the plan pays for itself. Every hour of an outage burns idle payroll, stalled revenue and recovery labor, and our article on the real cost of IT downtime works through that math. A rehearsed emergency mode shortens the most expensive stretch. The other half of shortening it is recovery itself: knowing how long your backups take to restore before the day you need them. That recovery-time work is what our backup and disaster recovery service builds and tests with clients.

During an incident, every employee is a potential spokesperson: to customers on the phone, on their own social media, to the friend asking why the office is closed. Uncoordinated statements cause three problems. They spread errors that must be corrected later, they can create legal exposure (picture a customer who was told "your data is fine"), and they give rumors a head start.

The plan names one voice, usually the incident lead or the owner, and gives everyone else a single line to use: "We know about a technical issue, we are working on it, and [name] will share updates." Anything said outside the company passes counsel first, especially statements about whose data was involved. Saying little and pointing to a named contact beats improvised reassurance every time.

Here is the entire plan as prompts. Answer them on a single page and you are finished.

Leadership

• Incident lead (name, cell): ________
• Deputy (name, cell): ________
• Authority: either person may disconnect any system and approve emergency spending.

Call order

• IT provider (name, after-hours number): ________
• Cyber insurer breach hotline (number, policy number): ________
• Counsel (name, cell): ________
• Notification-clock owner (name) and the rules that apply to us: ________

Containment

• Pre-authorized to isolate: any system, including [EHR / order system / phones], during business hours.
• Printed in bold: disconnect, do not power off; preserve, do not wipe.

Emergency mode

• Paper process for [orders / intake / service], and where the forms are kept: ________
• Phone triage, meaning who answers and what they say: ________
• The three customers or partners we call personally: ________

One voice

• Spokesperson: ________
• The single sentence everyone else uses: ________

Logistics

• Printed copies kept at: [office location], plus one at home with each person named here.
• Last tabletop date: ________ Next tabletop: ________

Complete it and resist adding more. Each extra detail is one more thing that can go out of date, and the one-page limit is what keeps the plan readable at 7 a.m.

A plan nobody has tested is a theory. Block two hours once a year, bring in the leadership team and your IT provider, and talk through one scenario out loud. Here is one you can use:

Monday, 7 a.m. The office manager calls to say nothing will open. Every workstation displays the same ransom note. Email is offline. The phones still ring, but the system behind them does not work. The first patient, customer or delivery shows up at 8.

Then walk down the page in order and ask the uncomfortable questions. Who declares an incident, and can the lead be reached right now? Actually dial their cell. What is the insurer's hotline, and does anyone know where the policy number is? Who physically unplugs the server, and do they know they have permission? What does the front desk say at 8:01? Who is checking whether a notification clock just started?

What the tabletop produces is a punch list of everything that creaked: a phone number that changed, a deputy who never knew they were the deputy, paper forms nobody printed. Fix the list, date the page, and schedule next year's session. Two hours a year is the whole maintenance cost of a plan that works, and as the baseline in our cybersecurity guide notes, businesses that rehearse get back on their feet far faster than businesses that improvise.

Two outside parties care about this plan, and it should reflect both.

Your insurer. Carriers increasingly ask about incident response plans on applications, next to MFA, EDR and tested backups, and those application answers are binding. More practically, the policy imposes duties the plan has to encode: notify the carrier before hiring outside vendors, use the approved response firms, and document everything. A plan that conflicts with your policy is a plan for a coverage dispute. Before renewal, read the claims-reporting section of your policy against your call order. Our guide to cyber insurance requirements for Houston businesses covers what carriers expect today.

Your regulators. In a regulated industry, notification duties are part of the response, not something to sort out afterward, which is why the plan names a notification-clock owner. Medical practices carry HIPAA breach notification requirements, financial firms covered by the FTC Safeguards Rule have their own reporting window, and any business holding personal data faces state notification laws. The page does not need to contain the law. It needs to name the person who starts working the deadlines in the first hour.

The final instruction sounds paranoid until the day it does not: print the plan. Its whole purpose is to work while your systems are unavailable. A plan saved on the file server that was just encrypted, or in a cloud folder behind an account you cannot get into, fails at exactly that moment. Keep paper copies at the office and one at home with every person named on the page. Whenever something changes, such as a provider, an insurer or a phone number, reprint and swap every copy. The tabletop punch list is the natural trigger.

Five decisions made ahead of time and written on one page: who is in charge, with a deputy and explicit authority to disconnect systems and spend money; who gets called and in what order; what gets isolated first, along with the forensic rules against powering off or wiping; how the business runs in emergency mode; and who speaks for the company. Long plans get written. Short plans get used.

Call your IT provider to start containment, then your cyber insurer's breach hotline right after, before you approve any other outside spending. Many policies require carrier notice first and specify approved vendors, and the insurer typically brings an incident response firm and breach counsel. Counsel and the person who owns your notification deadlines complete the call order.

Once a year, as a two-hour tabletop. Leadership and your IT provider talk through one written scenario, such as "Monday at 7 a.m., nothing opens," from discovery through customer communication. The result is a punch list of stale numbers, unclear authority and missing paper forms, fixed on a quiet afternoon instead of during a real event.

More and more often, yes. The question appears on applications alongside MFA, EDR and tested backups, and application answers are binding. Policies also impose duties the plan has to reflect, including notifying the carrier before spending money and using approved response vendors. A plan that contradicts the policy invites a coverage dispute.

Because the plan is needed exactly when systems are unavailable. A copy on a file server that ransomware just encrypted, or in a cloud account you are locked out of, fails at its only job. Keep paper copies at the office and with every person named in the plan, and reprint whenever a name or number changes.

If you want a second set of eyes on your finished page, or you would rather build it together with the backup and restore testing that turns "how long until we are back?" into a real answer, contact Talos Automation or call (346) 330-3390. Our team builds and tabletops these plans with Houston businesses as a routine part of managed cybersecurity, and we will pressure-test yours against what attackers, insurers and regulators will actually throw at it.