Cybersecurity Incident Response Plan: A Template for Small Businesses
A cybersecurity incident response plan is a written guide to what your business does when something goes wrong: who is in charge, how to contain the problem, how to preserve evidence, who must be told and how to recover. It should fit on a few pages, name real people and phone numbers, and be tested at least once a year. The template below covers the essentials.
Why you need one before anything happens
During an incident, people panic, delete evidence, pay fraudsters or wait too long to call the bank. A plan turns a crisis into a checklist. It also helps you meet legal deadlines. In Nigeria, personal-data breaches likely to put people at risk must be reported to the NDPC within 72 hours, and cyber incidents in scope of the Cybercrimes (Amendment) Act 2024 to ngCERT within 72 hours of detection (Aluko & Oyebode).
The six phases
| Phase | Goal | Key question |
|---|---|---|
| 1. Prepare | Be ready before anything happens | Do we know who to call and where our backups are? |
| 2. Detect | Notice that something is wrong | Is this a real incident, and how serious is it? |
| 3. Contain | Stop it spreading | What do we disconnect or lock right now? |
| 4. Eradicate | Remove the cause | How did they get in, and is it closed? |
| 5. Recover | Restore normal operations safely | Are systems clean before we reconnect? |
| 6. Learn | Prevent a repeat | What will we change? |
This follows the widely used incident-handling model published by NIST.
The template
Section 1: Roles and contacts
| Role | Name | Phone | Backup person |
|---|---|---|---|
| Incident lead (makes decisions) | |||
| IT / security contact (internal or provider) | |||
| Communications (staff, customers, media) | |||
| Legal / data protection officer | |||
| Bank fraud line | |||
| Cyber insurer (if any) |
Keep a printed copy. If email or the network is down, you still need these numbers.
Section 2: How to classify an incident
| Severity | Examples | Who to involve |
|---|---|---|
| Low | A phishing email reported, nobody clicked | IT contact |
| Medium | One account compromised, no data taken | Incident lead + IT |
| High | Ransomware, payment fraud, or a personal-data breach | Everyone above, plus legal and insurer |
Section 3: The first-hour checklist
- [ ] Don't switch off affected computers (that can destroy evidence). Disconnect them from the network instead.
- [ ] Reset passwords for affected accounts from a clean device, and sign out all sessions.
- [ ] Call the bank immediately if money was sent, and ask for a recall.
- [ ] Preserve evidence: screenshots, emails with headers, logs. Don't delete anything.
- [ ] Start an incident log: what happened, when, who did what.
- [ ] Decide who needs to know inside the business. Keep it need-to-know.
Section 4: Containment playbooks
- Compromised email account: reset the password, revoke sessions, remove suspicious forwarding rules, check sent items, warn contacts who received fraudulent emails.
- Ransomware: isolate affected machines, protect backups (disconnect them), identify the variant, involve specialists. Agencies such as the FBI and CISA advise against paying.
- Lost or stolen device: remote lock and wipe, reset the passwords it stored.
- Payment fraud: bank recall, police report, review payment approval controls.
Section 5: Notification
- [ ] Is personal data involved? If it's likely to put people at risk, notify the NDPC within 72 hours, and the affected people without undue delay where the risk is high.
- [ ] Is it a cyber incident in scope of the Cybercrimes Act? Report to ngCERT (through your sector CERT where one exists) within 72 hours of detection.
- [ ] Do contracts require you to tell clients?
- [ ] Does your insurer need to be told before you engage outside help?
Take legal advice on what applies to your organisation.
Section 6: Recovery
- Restore from known-clean backups.
- Patch the weakness that was exploited.
- Monitor closely for re-entry for the following weeks.
Section 7: After-action review (within two weeks)
- What happened, and when did we notice?
- What worked? What slowed us down?
- Which three changes will we make?
Test it
Run a 60-minute tabletop exercise once a year. Read out a scenario ("Finance has just paid a fake supplier invoice of $20,000") and walk through the plan. Most gaps show up within ten minutes.
See also: business email compromise and 12 essential controls.
Frequently asked questions
Does a small business really need an incident response plan?
Yes. Smaller businesses usually have fewer people and less time to work things out under pressure, so a short written plan makes the biggest difference for them.
How long should an incident response plan be?
For most small and mid-sized businesses, three to six pages. Long enough to cover roles, contacts and the first actions, and short enough to use in a crisis.
Who should lead incident response?
A senior person with authority to make decisions quickly, such as an operations director, supported by an IT or security provider. It doesn't have to be a technical person.
How often should the plan be updated?
At least once a year, after every real incident, and whenever key people, systems or providers change.
Want a plan built around your business?
Eleova writes and tests incident response plans as part of our cybersecurity work. Risk assessments start from $499. Talk to our security team →