A cyber incident response plan is a short, written playbook for what your business does in the first hours after a cyber incident — who does what, in what order, with what contact numbers. Its value is decided before any incident: teams without a plan improvise under pressure and lose evidence, time and money; teams with one contain in minutes. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports in 2024-25, with average self-reported costs of $56,600 for small businesses — and response speed is one of the few factors that changes that number. This guide walks through what a plan needs and how to build one in an afternoon.
TL;DR
- A cyber incident response plan is a written playbook: who does what in the first hours of an incident.
- Six sections: roles, escalation, containment, contacts, communication, recovery.
- One page beats a binder — the plan must work at 2am under stress.
- Test it twice a year with a tabletop exercise, then update it.
- Recovery depends on backups you have actually tested restoring.
What an incident response plan contains
A workable plan for a small business fits on one page. Six sections:
- Roles. Who declares an incident, who leads containment, who talks to staff, who talks to customers. In a 20-person business this is three names, not three departments.
- Escalation triggers. What counts as an incident — a reported phishing email is not; a confirmed login from an attacker's session is. Write the threshold down.
- First-hour actions. Isolate affected devices, preserve evidence, disable compromised accounts. Keep it imperative and ordered.
- Contacts. IT provider, insurer, ReportCyber, legal. With phone numbers, not links. ReportCyber coordinates police and bank action in Australia.
- Communication rules. What staff may and may not say externally; the plain-language template for customer notification if personal data is involved.
- Recovery steps. Restore from backups, verify integrity, reset credentials, and fix the entry point before reopening.
How to build the plan in one afternoon
- List the scenarios. Ransomware, compromised email, payroll diversion, lost device. Four is enough.
- Name the roles. Real people, real phone numbers. Decide who is in charge when the owner is unreachable.
- Write the first-hour steps per scenario. Imperative verbs, numbered, no prose.
- Collect the contacts. Confirm the insurer's cyber hotline and the IT provider's after-hours path — the numbers nobody has until they need them.
- Set the escalation threshold. "Reported phishing email → log it. Confirmed compromise → invoke the plan." One line.
- Write the customer notification template now, not during the incident. Plain language, what happened, what data, what we did, what you should do.
- Store it where it survives the incident. Printed copy plus an offline location — if the only copy is on the encrypted network, the plan failed with the network.
Why most plans fail when used
- Nobody can find it. A plan stored only on the file server fails with everything else.
- Roles are job titles, not names. "The IT department" does not answer the phone at 2am; a person does.
- Backups were never tested. Recovery depends on restoring — if no one has verified a restore in the last six months, the recovery section is fiction.
- No contact tree. The plan assumes people will check email, which is often the compromised system.
- Never rehearsed. A plan nobody has walked through collapses under first use.
How to test the plan
Twice a year, 30 minutes: hand the team a scenario — "it is 8:15 Monday, payroll runs at 9, three staff report their email is sending spam" — and have them walk the plan aloud, from detection to customer notification. Note every step where someone hesitated or a number was missing; fix those lines. Then verify one backup restore for real.
Human risk reporting adds the measurement layer between drills: which staff report suspicious emails fastest, where the reporting reflex is thin, and whether the trend is improving. A plan plus a measured reporting reflex is the difference between a contained incident and a week of downtime.
First-hour actions by incident type
The plan's first-hour section works best as a short table the response lead can follow without thinking:
| Incident | First actions | Do not |
|---|---|---|
| Ransomware detected | Disconnect affected machines from the network; preserve one machine for the responder; invoke insurer and IT provider | Do not shut down or wipe; do not open the ransom note's links |
| Compromised mailbox | Revoke sessions, change the password from a clean device, check forwarding rules and delegated access, alert anyone the attacker emailed | Do not delete the evidence emails |
| Payment fraud reported | Call the bank for recall immediately, then ReportCyber; notify the impersonated supplier | Do not email the "supplier" address back |
| Lost device | Remote-wipe if enrolled, revoke sessions and MFA enrolment, assess what data it held | Do not wait to see if it turns up |
Every row assumes the same opening move: contain first, investigate second, communicate third. The table is why the plan fits on one page — the detail lives in the drills, not the document.
FAQ
What is a cyber incident response plan? A short written playbook for who does what in the first hours of a cyber incident — roles, first-hour actions, contacts, communication rules and recovery steps.
How long should an incident response plan be? For a small business, one page. Longer documents go unread at the moment they are needed; the plan must work under stress at 2am.
How often should we test it? Twice a year with a tabletop exercise, plus a real backup-restore verification at least every six months. Update the plan after every exercise and every real incident.
Do small businesses legally need one? No general legal requirement, but regulated sectors and insurers increasingly expect documented incident procedures, and privacy-law notification duties apply regardless — a plan is how you meet them on time.
What is the first thing to do during an incident? Contain: isolate affected devices and disable compromised accounts. Do not shut down machines (you destroy evidence) and do not wipe anything — preserve logs for the responders.
One last thing
The single highest-value hour in security for a small business: write the plan, print it, and put it in the drawer everyone knows. Then book the first tabletop for the next team meeting. An untested plan is a wish; a tested one is a control.