A small business cyber incident response plan is a one-to-three page document naming who does what in the first 72 hours of a cyber incident: who declares it, who isolates systems, who calls the insurer, who talks to customers, and who decides on notifications. In 2026 most small businesses have backups but no plan — so the first two hours of an incident get spent working out who is in charge instead of containing damage.
TL;DR
- Six sections cover a small business: roles, triggers, first-72-hour playbook, contacts, decision rules, templates.
- Keep the whole document under three pages; a plan nobody can read at 9 pm is not a plan.
- The Privacy Act's Notifiable Data Breaches scheme requires notifying the OAIC and affected people when a breach is likely to result in serious harm, with assessment within 30 days of becoming aware.
- Rehearse twice a year with a 30-minute tabletop exercise; incidents do not test the plan, people do.
- Plug phishing response into the plan: see what to do when an employee clicks a real phishing link.
What a small business incident response plan includes
- Roles and contacts. Named people with phone numbers, not job titles alone. Include a backup for every role.
- Trigger definitions. What counts as an incident: ransomware note, payroll diversion, credential compromise, lost device, a supplier breach.
- The first-72-hour playbook. Hour-by-hour actions in checklist form, written for a stressed reader.
- External contact block. Insurer cyber claims line, IT provider or MSP, legal adviser, accountant, web host, the OAIC, ReportCyber, your bank's fraud line.
- Decision rules. Who pays a ransom (answer: nobody decides alone), who notifies customers, who talks to media, when systems come back online.
- Templates. Customer email, supplier email, staff email, and the OAIC notification form. Written before the incident, not during.
Roles: four names and four backups
A plan with committees is a plan nobody executes. Four roles cover a small business:
- Incident lead declares the incident and owns the checklist. Usually the owner or operations manager.
- Technical lead isolates systems, preserves evidence, works with the MSP. In-house IT or your outsourced provider — name the individual who answers their phone.
- Communications lead handles customers, staff and suppliers with the templates.
- Decision maker owns the hard calls: ransom, notifications, downtime. In a five-person business this is the owner, and it is the same person as the incident lead — which is why the backup matters.
The first 72 hours: hour-by-hour playbook
- Hours 0-2: contain. Disconnect affected devices from the network (pull the cable; do not power off machines you may need for forensics). Disable the compromised accounts. Do not delete anything.
- Hours 2-4: declare and escalate. The incident lead declares the incident, and the insurer's cyber claims line is called before vendors are engaged — many policies require pre-approval of forensic and restoration costs.
- Hours 4-24: preserve and assess. Preserve logs, capture what the attacker touched, assess what data and systems are affected, and verify your backups are intact and clean.
- Hours 24-72: communicate and decide. Send the staff and supplier emails, decide on customer notifications, reset credentials, and start restoring from verified-clean backups.
Australian reporting obligations in 2026
If the Privacy Act 1988 covers your organisation, a data breach involving personal information must be reported to the OAIC and to affected individuals when it is likely to result in serious harm, and the assessment must be completed within 30 days of becoming aware of it. Cyber incidents affecting personal information are notifiable events — see what counts as a notifiable data breach in Australia. Report criminal incidents such as ransomware or BEC to ReportCyber, the Australian Signals Directorate's online reporting service, and tell your bank immediately when money has moved: early contact is the difference between a recall and a write-off.
Rehearse it: the 30-minute tabletop
Twice a year, book 30 minutes and read the plan out loud against one scenario: it is 8:47 pm on a Friday and payroll has not landed because a fake supplier email moved the account three days ago. Everyone says what they would do first. Every gap the exercise exposes becomes an edit to the plan. Incidents do not test documents; they test people, and the rehearsal is the only cheap way to find out who was never going to answer their phone.
Common failure points
- The plan names the MSP's office number, not the after-hours engineer. Incidents do not keep business hours.
- The insurer is called after the forensics vendor. Pre-approval requirements are common and retrospective approval is not.
- Nobody has the OAIC notification form bookmarked. Download it into the plan today.
- Backups were never restore-tested. An untested backup is a hope, not a recovery.
- The phishing playbook lives somewhere else. Human-driven incidents are the most common small-business entry point, and the response belongs in this same document — the same-day steps in the phishing-link playbook link directly into hours 0-2 here.
FAQ
What is a cyber incident response plan for a small business? A one-to-three page document naming who does what in the first 72 hours of a cyber incident: roles, triggers, the hour-by-hour playbook, external contacts, decision rules and pre-written communications templates.
Do small businesses legally need an incident response plan in Australia? No statute names the document, but the Privacy Act's Notifiable Data Breaches scheme assumes you can detect, assess within 30 days and notify — and insurers, tenders and supply-chain partners increasingly ask for the plan as evidence.
How long should the plan be? Under three pages. Longer documents are not read during an incident, and the playbook is the only section a stressed reader needs.
Who should write it? The owner with the MSP and the accountant in the room. The technical content comes from whoever runs the systems; the decision rules come from whoever owns the business.
How often should it be rehearsed? Twice a year with a 30-minute tabletop exercise, plus an update whenever staff, suppliers or systems change materially.
When must a breach be reported to the OAIC? When personal information is involved and the breach is likely to result in serious harm, with the assessment completed within 30 days of becoming aware of the breach.
One last thing
The cheapest resilience upgrade in the plan is the contact block. Print the after-hours numbers of your insurer, your MSP's on-call engineer and your bank's fraud line, and tape the page inside the office. When an incident starts, the difference between hours 0-2 going well and going badly is usually nothing more sophisticated than a phone number that answers.