How to write an incident response plan for a small business

A small business incident response plan should say who is in charge during an incident, who to call (with phone numbers that don't depend on your computers), the first steps to take, how you'll keep talking to staff and customers if email is down, who decides what to report, and how you'll recover. Keep it to a couple of pages, keep a printed copy, and practise it once a year.

How many small businesses have one?

In the government's Cyber Security Breaches Survey 2025/26, only 25% of businesses had a formal incident response plan, falling to 21% of micro businesses. Even simpler measures were missing in most: 39% had assigned roles or responsibilities for incidents, and 34% had written guidance on who to notify.

So if you don't have a plan yet, you're in the majority. The good news is that the most useful parts take an afternoon to write.

Why a plan matters

During an incident, people are stressed, systems may be down and every decision feels urgent. A plan means the important decisions were made calmly in advance: who leads, who calls the insurer, whether to disconnect, what to tell customers. It also helps you meet the deadlines that apply, such as reporting a personal data breach to the ICO within 72 hours where required.

The NCSC's incident management guidance recommends defining everyone's roles, appointing specific people (or an incident response supplier) to handle incidents, including basic guidance on legal and regulatory reporting, and updating your plan after every incident.

An outline you can adapt

Copy these headings into a document and fill them in for your business. Each one only needs a few lines.

1. Who's in charge

• Incident lead: the person who makes decisions and keeps everyone coordinated. Usually a director.
• Deputy: who takes over if the lead is away, including evenings and weekends.
• Who does what: who talks to your IT provider, who talks to staff, who talks to customers, and who keeps the log.

2. Who to call

A contact list with phone numbers, kept on paper as well as on your computers:

• Your IT provider or security provider, including an out-of-hours number
• Your cyber insurer's incident helpline and your policy number
• Your bank's fraud line
• For an attack in progress: 0300 123 2040, the 24/7 line for businesses suffering a live cyber attack. In Scotland, call Police Scotland on 101
• The ICO, through its online breach reporting form
• Your solicitor, and any professional regulator you report to
• Directors' and key staff's personal mobile numbers

3. How staff raise the alarm

Who should staff tell if they see something odd, clicked a suspicious link or can't open their files? Make it one named person (and a backup), make it quick, and make it clear nobody will be in trouble for reporting.

4. The first steps

Write down the first few actions for the incidents you're most likely to face, or point to guides you trust. Ours cover the first hour of a ransomware attack and what to do when a Microsoft 365 or Google Workspace account is hacked. Include who is allowed to disconnect systems, and when to call for specialist help.

5. How you'll communicate

If email, Teams or your phone system may be compromised or down, how will you reach staff, customers and suppliers? A printed phone list and an agreed way to contact each other from personal phones avoids scrambling on the day. Decide in advance who speaks for the business, and that nothing is said publicly until the facts are checked.

6. Who decides what to report

Name the person who decides reports to the ICO, the police, your insurer, your bank and your customers, and when. Our guide, Do we need to report a cyber attack?, explains the rules.

7. Keeping the business running

List your most important systems and what you'd do without each of them for a day or a week: take orders by phone, issue paper invoices, use a spare laptop. Note which you'd restore first.

8. Recovery

Where your backups are, who can restore them, and how long a restore takes. The NCSC advises practising restores and copying back only clean data onto clean systems, so you don't let the attacker straight back in.

9. The incident log

What happened, when, what you did, who you told and why you made each decision. A paper notebook works. It's what your insurer and the ICO will want to see, and the NCSC recommends keeping a careful record of decisions and actions.

10. Afterwards

Agree to hold a short review after every incident (however big or small) or every near miss: what worked, what didn't, and what you'll change. Then update the plan.

Keep it where you can find it

A plan saved only on the server that's just been encrypted is no use. Keep printed copies with the incident lead and deputy, a copy somewhere outside your main systems, and make sure your key staff know where they are.

Practise it

A plan nobody has tried usually has gaps: a number that's changed, a password only one person knows, a backup nobody has tested. A short tabletop exercise, where you talk through a made-up incident round a table, finds them.

The NCSC's Exercise in a Box is free and includes small businesses: it has 20 exercises across 12 topics, including ransomware and phishing, with everything you need to run one yourself. An hour once a year is enough to keep the plan honest.

Where we can help

Our incident readiness service helps you write a plan that fits your business and test it with your team. If something happens before you're ready, emergency incident response is there, and our MDR Plus tier includes full incident response with no hourly cap.

If you'd like to talk it through, get in touch.

< Back to Guides