By Akash Sengar · · 7 min read
Why a small business needs a written plan
When ransomware locks your files or a mailbox is taken over, the first hour decides how bad it gets. Without a plan, people switch off the wrong things, wipe evidence, or wait too long to report. A good incident response plan is short enough to read under stress: two to four pages, printed and stored outside your systems.
If something is happening right now, go straight to our incident response page.
Roles and the contact list
Name people, not job titles, and a deputy for each:
- Incident lead: makes decisions and keeps the timeline.
- Technical lead: your IT person or provider, who contains and investigates.
- Communications: speaks to staff, customers and, if needed, the media.
- Legal and compliance: decides what must be reported and when.
The contact list should include phone numbers that do not depend on your email: your IT provider, cyber insurer, bank fraud desk, lawyer, domain registrar, and key SaaS vendors' support lines.
Severity levels
| Level | Example | Response |
|---|---|---|
| Low | A single phishing email reported, no clicks | Block sender, note it |
| Medium | One account compromised, quickly contained | Reset, investigate, check reporting duties |
| High | Ransomware on several devices, data exposed or systems down | Full plan, leadership, reporting clocks start |
What to do after a cyber attack: the first hour
- Write down the time you noticed and what you saw. Start a simple timeline.
- Contain: disconnect affected devices from the network (unplug the cable or turn off Wi-Fi) but do not switch them off, because memory can hold evidence.
- Disable or reset compromised accounts, revoke sessions and check mail forwarding rules.
- Protect backups: disconnect or lock them so they cannot be encrypted too.
- Call your IT provider and your cyber insurer. Many policies require early notice and a panel firm.
- Decide whether the incident is reportable, and start the clocks below.
Incident response plan template for a small business
You do not need a long document. A plan that fits on a few pages usually has these sections:
- Purpose and scope: which systems, data and locations it covers.
- Roles: names, deputies and how to reach them outside company email.
- How to report a suspected incident: one phone number or channel staff can use at any hour.
- Severity levels: the table above, with who must be told at each level.
- First-hour checklist: the steps above, in order.
- Playbooks: one page each for ransomware, a compromised mailbox, a lost or stolen laptop and data sent to the wrong person.
- Reporting duties: CERT-In, the DPDP Board and affected people, sector regulators, insurers and clients whose contracts require notice.
- Contacts: internal and external, checked every quarter.
- Record template: timeline, decisions, evidence and who was told.
Keep a printed copy and an offline copy, because the systems holding the plan may be the ones affected.
Playbook example: a compromised mailbox
Business email compromise is one of the most common incidents in small businesses. A short playbook might say: reset the password and revoke all sessions; check and remove forwarding and inbox rules the attacker created; review sign-in logs for the source and time of access; check whether the mailbox sent payment requests or changed bank details; warn the recipients of any fraudulent messages by phone; turn on or enforce multi-factor authentication; and decide whether the incident is reportable to CERT-In.
Ransomware response plan
Ransomware deserves its own page in the plan. Identify which systems are encrypted, find the earliest clean backup, and confirm the attacker's access is removed before you restore, or the attack can repeat. Expect that data may also have been copied out, which affects your reporting duties. Whether to pay is a decision for leadership with legal advice; paying does not guarantee recovery.
Preserving evidence
- Keep logs: firewall, Microsoft 365 or Google Workspace audit logs, endpoint and server logs. CERT-In's April 2022 directions require organisations to keep logs of their ICT systems for 180 days within India (CERT-In Directions).
- Save suspicious emails as attachments rather than forwarding them.
- Take photos of ransom notes and screens.
- Do not reimage machines until you know whether forensics is needed.
Reporting to CERT-In within 6 hours
Under the CERT-In directions of 28 April 2022, service providers, intermediaries, data centres, body corporates and government organisations must report specified cyber incidents to CERT-In within 6 hours of noticing them or being told about them (CERT-In Directions). The listed types include ransomware, compromise of systems or email accounts, data breaches and leaks, and attacks on servers and applications.
The report can start with the information you have and be completed later. Our CERT-In incident reporting guide explains what to send and how.
DPDP breach notice (from 13 May 2027)
Once the Digital Personal Data Protection Act's main duties apply on 13 May 2027, a personal data breach must be reported to the Data Protection Board and to each affected person. Rule 7 of the DPDP Rules, 2025 requires an intimation without delay, then a detailed report to the Board within 72 hours, or longer if the Board allows. Add both steps to your plan now so they are rehearsed by then.
Keep a short reporting log for every notifiable incident: who reported, to whom, when, the reference number received and what was said. Regulators, insurers and auditors will ask for it later.
Cyber crime helpline 1930
In India, financial cyber fraud can be reported by calling the national helpline 1930, and any cyber crime can be reported on the National Cyber Crime Reporting Portal at cybercrime.gov.in. If money has been sent to a fraudster, call 1930 and your bank immediately; speed matters for stopping the funds.
Tell your cyber insurer early, too; most policies set their own notice period.
Communication
- Use a channel the attacker cannot read, such as phone or a separate messaging group, if email may be compromised.
- Give staff a short holding message and tell them not to post about it.
- Prepare customer wording with your legal adviser, factual and without speculation.
Lessons learned
Within two weeks of closing an incident, hold a short review: what happened, what worked, what did not, and what changes. Record actions with owners and dates. Update the plan and contact list.
Testing the plan
Run a tabletop exercise at least once a year: a 60-minute walk-through of a realistic scenario, such as "the finance mailbox was taken over and sent fake bank details to customers". Check that people know their roles, that phone numbers work and that backups can actually be restored. Each test usually finds a gap worth fixing.
