Data Breach and Incident Response Plan for Small Business: A Template
Most security incidents at small businesses are not dramatic. A mailbox is taken over and used to redirect a payment. A laptop is left on a train. An employee installs something they should not have. A server starts encrypting on a Friday night. The businesses that recover well are the ones that had already decided who does what, in writing, before it happened. This article replaces four older ones, on responding to attacks, spotting a hacked server, keeping hackers out and why anyone would target you, with a plan you can complete in an afternoon. It pairs with our disaster recovery plan template, which covers getting systems back; this one covers the incident itself.
Why small businesses are targeted
Owners still ask why anyone would bother with them. The answer is that attacks are automated and indiscriminate, and small businesses have exactly what criminals want: bank accounts that pay invoices, customer data that sells, email that can be used to attack customers and partners, computers that can host someone else’s crime, and defences thinner than an enterprise’s. The FBI counts business email compromise losses in the billions of dollars every year, and most of it is taken from businesses of under 100 people. Nobody is too small; some are too unprepared.
How incidents show themselves
The signs are mundane, which is why they are missed. People receiving multi-factor prompts they did not request. A login from another country in the Microsoft 365 sign-in log. New inbox rules that delete or forward mail. A customer asking about an invoice with changed bank details. Files renamed with a strange extension, or disappearing. Antivirus disabled, or software nobody installed. A server or computer suddenly slow with the fan running. Locked-out accounts, changed passwords, or an administrator account nobody recognises. Under a managed plan, endpoint detection and identity monitoring raise most of these before a person notices; the plan still needs to tell staff what to do when they see one, which is simply: report it, immediately, to a named person, and do not try to fix it.
The plan
1. Roles and contacts
Who is the incident lead (usually the owner or a senior manager), who runs the technical response (your IT provider), who handles communications, who contacts the insurer and counsel, and who covers each role when they are away. Names, mobile numbers, and the numbers for the IT provider’s emergency line, the cyber insurer’s incident hotline with the policy number, the bank’s fraud line and the FBI’s Internet Crime Complaint Center.
2. Reporting
One sentence every employee knows: if something looks wrong, call this number now, and do not turn anything off, delete anything or keep using the machine. Print it. Reward reporting, including false alarms; the cost of a missed one is far higher.
3. Triage
The incident lead and the technical lead decide within the first half hour what kind of incident it is, because the first steps differ:
| Incident type | First 24 hours |
|---|---|
| Business email compromise (a mailbox taken over) | Revoke all sessions and reset the password from a clean device; remove forwarding and inbox rules; check what was sent and to whom; call the bank immediately if any payment was diverted, since recalls are possible only within a day or two; warn counterparties who received messages; review the sign-in log for other accounts; turn on MFA if it was off |
| Ransomware | Disconnect affected machines from the network without powering off; protect the backups; call the provider and insurer; do not pay or communicate; preserve the note; follow the detailed steps in our ransomware response article |
| Lost or stolen device | Remote-wipe it through device management; confirm it was encrypted; revoke its sessions and rotate any credentials stored on it; report the theft; decide with counsel whether data was exposed |
| Malware on a computer | Isolate it; let endpoint detection contain and report; identify what it was and how it arrived; reset the user’s credentials; rebuild rather than clean if in doubt |
| Insider misuse or a departing employee | Disable accounts and revoke access immediately; preserve logs and mailboxes rather than deleting; involve HR and counsel before confronting anyone; follow the offboarding checklist |
| Vendor or third-party breach | Find out what data of yours they held; reset any shared credentials; watch for phishing that uses the vendor’s name; document what you were told and when |
4. Containment principles
Contain the smallest thing that stops the damage: one mailbox, one machine, one network segment, rather than the whole business, unless the whole business is affected. Isolate rather than power off, because memory holds evidence. Change credentials only from a device you trust. Keep a written timeline from the first minute: who did what, when.
5. Evidence
Do not wipe, rebuild or delete until the technical lead says the evidence is captured. Keep the phishing email, the ransom note, the sign-in logs, the disk image. Insurers, regulators and, occasionally, courts will ask for them. Endpoint detection records and Microsoft 365 audit logs are the main sources, which is a reason to have both turned on before an incident.
6. Notification
A matrix of who is told, by whom, by when:
- Cyber insurer: within hours; most policies require it and provide the response firm and counsel.
- Counsel: as soon as personal data may be involved; they decide the legal notifications.
- Law enforcement: the FBI’s Internet Crime Complaint Center for any financial fraud or ransomware; local police for theft.
- Bank: immediately for any diverted payment.
- Affected individuals and regulators: as counsel directs. Minnesota’s breach law requires notice to residents without unreasonable delay; HIPAA sets 60 days for patient data; card brands have their own rules; defence contractors report to the Department of Defense within 72 hours.
- Customers, partners and staff: a short, factual message, from one named person, updated as facts are confirmed and never ahead of them.
7. Eradication and recovery
Close the entry point (the phished account, the unpatched firewall, the exposed remote desktop), remove what the attacker left, rebuild affected systems from known-good media and restore data in the order the disaster recovery plan sets out. Increase monitoring for the following month; re-entry attempts are common. For ransomware, our article on what to do when infected is the detailed procedure.
8. Review
Within two weeks, a meeting with everyone involved: what happened, how it got in, what worked, what did not, and what changes. The changes are usually the same short list: MFA where it was missing, patching where it lagged, a control that existed on paper, a person who did not know whom to call. Update the plan and the prevention controls.
Testing the plan
Once a year, gather the people named in the plan for an hour and walk through a scenario: the finance manager’s mailbox was phished and a $40,000 payment went to the wrong account this morning. Who noticed, who called whom, what was revoked, who called the bank, what was told to the customer. The exercise finds the gaps in an hour and gives you a tested date for the insurance application. Our vCISO service runs these with clients, and the cyber insurance readiness check shows how the plan maps to the questions insurers ask.
Keeping incidents rare
The plan is for the day something gets through. Most days, the goal is that nothing does: MFA on every account, a supported firewall that is patched and reviewed, endpoint detection with a 24/7 team behind it, email filtering, least privilege, tested backups and trained staff. Each is covered in how to prevent ransomware attacks, the dangers of an outdated firewall and firewalls, antivirus and EDR, and all of them are part of our managed cybersecurity services. Under a managed plan the response steps above are largely done by the monitoring team and us before the incident lead has finished the first phone call, which is the difference a plan and a provider together make.
Free tools from OAC Technology
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- Phishing quiz: ten realistic emails, one at a time, with the tells explained
- Cloud backup pricing calculator: a monthly figure for server and Microsoft 365 backups
Common questions
What counts as a data breach?
Legally, unauthorised access to personal information that the law protects: names with account numbers, Social Security numbers, health information, card data and similar. Practically, any incident where someone who should not have had access did, until you can show otherwise. Not every incident is a breach, but every incident needs the same first steps.
Do we have to notify customers?
If personal information was accessed, usually yes. Minnesota’s breach law requires notice to affected residents without unreasonable delay, HIPAA sets 60 days for patient data, card brands have their own rules and defence contractors must report to the Department of Defense within 72 hours. Counsel decides which apply; the plan makes sure counsel is called in time.
How fast do we have to act?
In hours, not days. A compromised mailbox is used within hours to redirect payments; a diverted wire can sometimes be recalled within a day or two and rarely after; ransomware spreads while people deliberate. Cyber-insurance policies typically require notice within 24 to 72 hours as well.
Who do we call first?
Your IT provider or security team to contain it, and your cyber insurer, in that order and within the first hour. The insurer assigns an incident-response firm and counsel; engaging outside help before they approve it can leave you paying for it yourself.
Can we handle an incident ourselves?
Containment steps such as disconnecting a machine or revoking sessions, yes, and the plan tells staff how. Investigation, evidence handling and legal notification need professionals: your provider, the insurer’s response firm and counsel. Doing it alone is how evidence is destroyed and deadlines missed.
What is a tabletop exercise?
A meeting, once a year, where the people named in the plan walk through a realistic scenario step by step: a phished finance mailbox, say, or ransomware on a Friday. It takes an hour, finds the gaps, and is what insurers and auditors mean when they ask whether the plan has been tested.
Talk to us
If your business does not have a written incident response plan, or has never tested the one it has, we will fill in this template with you and run the first tabletop exercise. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
