An incident response plan is what turns a chaotic Monday morning into a managed situation. It does not need to be long. A clear 10 to 15 page plan that people have actually read beats a 90-page template that sits in a shared drive, which, during ransomware, will be encrypted anyway.
What Phases Does an Incident Response Plan Cover?
Most plans follow the lifecycle described in NIST's incident handling guidance (NIST SP 800-61):
- Preparation. Tools, contacts, training, backups and the plan itself.
- Detection and analysis. How incidents are spotted, triaged and classified.
- Containment, eradication and recovery. Stop the spread, remove the attacker, restore operations.
- Post-incident activity. Lessons learned and improvements.
NIST CSF 2.0 frames these as the Respond and Recover functions.
What Should a Small Business Incident Response Plan Include?
| Section | What to include |
|---|---|
| Scope and definitions | What counts as an incident; severity levels with examples |
| Roles | Incident lead, decision-maker for shutdowns and spending, communications lead, privacy lead |
| Contact list | Insurer breach hotline and policy number, IT provider, MDR/SOC provider, legal counsel, incident response firm, bank, key clients |
| Escalation | Who is called, in what order, for each severity level |
| Playbooks | Short steps for ransomware, Microsoft 365 account takeover, business email compromise, lost device, data exposure |
| Evidence handling | Do not wipe; preserve logs; document actions with times |
| Communications | Internal messages, client notices, media holding statement |
| Legal and regulatory | Breach assessment under PIPEDA, Quebec Law 25, Alberta PIPA, sector rules, contractual notice |
| Recovery priorities | Which systems come back first, with recovery time objectives |
| After-action review | How lessons learned are captured and acted on |
Who Should Be on the Incident Response Team?
For a 50 to 300 person business, typically:
- Executive sponsor(CEO, COO or owner): makes business decisions.
- Incident leadcoordinates the response, often IT manager or vCISO.
- IT provider or internal ITtechnical actions.
- Security providerinvestigation and containment.
- Privacy officer or legal counselbreach notification decisions.
- Communicationsstaff, client and media messages.
- Financeinsurer contact, emergency spending, bank liaison.
Name a backup for each role. Incidents love long weekends.
Why Do You Need a Copy Offline?
Because during a serious incident your email, Teams and file shares may be unavailable or compromised. Keep a printed copy, and a copy on a personal device or a separate secure service, with phone numbers. Agree on an alternative communication channel, such as a group phone call or a separate messaging app, in case attackers are reading corporate email.
How Often Should You Update and Test It?
Review the plan at least annually and after any significant change: new IT provider, new insurer, an acquisition, a major system migration. Test it with a tabletop exercise at least once a year. Many insurers and frameworks ask whether you have a plan and whether it has been tested.
Where Do You Start?
- List your contacts and put them on one page.
- Decide who can authorize shutting systems down.
- Write a one-page playbook for ransomware and one for account takeover.
- Store it offline.
- Run a 90-minute tabletop.
Our incident response team helps write plans and runs tabletops, and a vCISO can own the plan over time. For the call list itself, see Who should I call after a cyber attack in Canada?.