Incident Response Plan for Small Businesses: A Starter Template
Create a practical response plan with roles, escalation contacts, containment decisions, evidence preservation, and recovery steps.
Assign roles
Name an incident lead, technical responders, business decision-maker, communications contact, and legal or privacy adviser where applicable. Keep an accessible offline copy of trusted contacts.
Define escalation
Describe incident triggers, severity levels, decision authority, and when to notify leadership or specialists. Include account takeover, ransomware, data exposure, payment fraud, and service disruption.
Contain safely
Document approved actions such as disabling compromised accounts, revoking sessions, isolating devices, and restricting risky integrations. Consider operational impact and preserve relevant logs.
Preserve and communicate
Record times, actions, affected systems, and decisions. Use trusted channels if corporate email may be compromised and coordinate external notifications with advisers.
Recover and learn
Restore verified backups, rotate affected credentials, fix root causes, and monitor for recurrence. Review the incident afterward and assign improvements.