One Hour Incident Response Plan for Small Businesses: Fill In Template

Your small-business incident response plan should be a short, leadership-approved document, ideally 2 to 4 pages, that names who can trigger the response and contains a one-hour checklist you can follow under pressure. Assign one person, an Incident Manager, the authority to act immediately. Everything else in your plan builds around that first hour.

TL;DR:

• The initial response focuses on isolating affected systems without rebooting or wiping drives, and notifying the incident manager immediately.
• The plan should outline clear roles, including an incident manager, technical lead, and communication officer, with printed contact tables stored off-network.
• Regular testing through quarterly reviews and annual tabletop exercises helps identify gaps in contact information and authority, ensuring readiness.
• Ransomware incidents require an immediate shutdown, snapshot preservation, and sequential notification to legal, insurers, and law enforcement, with recovery prioritized by system importance.
• Building a concise, well-practiced plan with designated authorities increases response speed and minimizes chaos during actual incidents.

Table of Contents

• What Goes in a Small Business Incident Response Plan Checklist?
• The Six Phases of an Incident Response Plan
• Who Does What: Roles, Authority, and Contacts
• What Do You Say, and Who Do You Call?
• How Often Should You Test Your Incident Response Plan?
• The Ransomware-Specific Response Sequence
• Build Your Own Template: Sections to Include
• Why Short, Practiced Plans Actually Get Used
• Get Help Building and Testing Your Plan
• Where to Find the Official Templates
• Sources
• FAQ

What Goes in a Small Business Incident Response Plan Checklist?

The first sixty minutes of a cybersecurity incident decide whether you’re dealing with a contained problem or a spreading one. CISA’s incident response guidance stresses evidence preservation and fast, decisive containment over trying to fully diagnose the problem before acting. Diagnose later. Contain now.

Here’s what happens in order, once someone confirms something is wrong:

1. Isolate affected systems. Unplug the network cable or disable Wi-Fi on infected machines. Don’t power them off.
2. Do not reboot compromised machines. Rebooting can wipe the memory evidence a forensic investigator needs, and it can also trigger destructive payloads in some ransomware strains.
3. Disable compromised accounts. Lock logins tied to the breach, starting with anything that has administrative access.
4. Preserve logs and snapshots. Copy firewall logs, server logs, and any available disk snapshots before anyone starts “cleaning up.”
5. Notify your Incident Manager. They activate the plan and start the clock on every subsequent step.

Once containment is underway, get the right people on the phone:

• Incident Manager (internal decision authority)
• Tech Manager or managed service provider
• Cyber insurance carrier
• Legal counsel
• Law enforcement (IC3 or your local FBI field office), for incidents involving theft, extortion, or significant financial loss

With calls made, move into short-term triage: rank your systems by how much damage a prolonged outage would cause, freeze any outgoing payments or wire transfers until you’ve confirmed accounts weren’t compromised, and check your backups for a recent, verifiably clean image before you assume recovery will be simple.

Pro Tip: Print this checklist and tape it inside a supply closet or filing cabinet. If your network is down or files are encrypted, a checklist that only lives on the network you can’t access is worthless.

The Six Phases of an Incident Response Plan

Every workable IRP, regardless of company size, follows the same six-phase structure. NIST’s incident response guidance organizes this life cycle so it aligns with the broader NIST Cybersecurity Framework 2.0, and it’s the backbone worth borrowing even if your business has five employees, not five thousand.

1. Preparation

This is the work you do before anything goes wrong, and it’s where most small businesses skip steps. A solid preparation phase includes:

• A current inventory of hardware, software, and cloud accounts
• A short list of your genuinely critical systems (email, point of sale, patient or client records, accounting)
• Offline or immutable backups, verified on a schedule, not just configured once and forgotten
• An authority matrix stating who can shut down a system or authorize emergency vendor spending
• A printed copy of the plan stored somewhere other than the network it protects
• Simple playbooks for the incidents you’re most likely to face: phishing, ransomware, stolen laptop, compromised email account

2. Identification

Not every alert is an incident, and not every incident is a crisis. This phase is about confirming something real happened, then classifying it. A useful, small-business-friendly severity scale looks like this:

Document what you found and when: the first alert time, who noticed it, what system triggered it. Investigators and insurers will ask for this timeline later, and memory fades fast under stress.

3. Containment

Containment splits into two moves. Short-term containment is what you did in the first hour: isolate, disable, disconnect. Long-term containment is what happens over the following days: rebuilding affected systems from clean images, forcing password resets across the organization, and tightening firewall rules so the same entry point can’t be used twice.

Evidence preservation matters through this whole phase. Don’t wipe a drive because it’s the fastest way to “fix” a machine. If you’re working with a forensic investigator or your cyber insurer requires an assessment, a wiped drive can cost you the claim.

4. Eradication

Once you’ve confirmed the threat is contained, remove it completely. That means deleting malware and backdoors, patching whatever vulnerability let the attacker in, and rotating every credential that touched the affected systems, not just the obviously compromised ones. Verify the removal with a scan or a second opinion from your IT provider before declaring the system clean.

5. Recovery

Restore from a backup you’ve actually verified as clean, not just the most recent one. Bring systems back online in stages rather than all at once, and watch each one closely for signs the threat is still present. Once restored, confirm your actual business processes work: can staff log in, does the point-of-sale system process a transaction, do orders sync correctly. A restored server that doesn’t support a working business process isn’t recovery.

6. Lessons Learned

Within a week or two of the incident closing, hold a retrospective. CISA and NIST both emphasize that this review should be blameless: the goal is finding what process or technology failed, not who to blame. Update the IRP with whatever you learned, and tell your staff what changed and why. A plan nobody knows was updated is functionally the same as a plan that was never written.

Who Does What: Roles, Authority, and Contacts

A plan without named owners just becomes a document people argue over during a crisis. CISA’s small business guidance recommends assigning three core roles before anything happens:

• Incident Manager (IM): Has authority to formally trigger the plan, coordinates the response, and owns the timeline. This should be a non-technical decision maker, not your IT lead, so technical staff stay focused on remediation instead of managing the clock.
• Tech Manager ™: Runs the technical response, whether that’s in-house IT or your managed service provider.
• Communications Manager (CM): Handles internal updates to staff and any external messaging to customers, partners, or press.

Escalation rules matter as much as the roles themselves. Decide in advance who can authorize taking a revenue-generating system offline, who can approve emergency spending on a forensic firm, and who signs off before any public statement goes out. A cybersecurity consultant can help business leaders work through exactly this kind of authority mapping before an incident forces the decision under pressure.

A sample contact table, filled in ahead of time and printed, looks like this:

Store a printed copy of this table somewhere off-network. Keep a second copy in a home safe or with a trusted manager, since a locked office during an incident is a real possibility, not a hypothetical one.

What Do You Say, and Who Do You Call?

The first hours after discovery aren’t just about technical containment. They’re also about controlled, accurate communication, and getting this wrong can create legal exposure worse than the incident itself.

Draft a short holding statement in advance, something your Communications Manager can adapt and release without composing language from scratch mid-crisis. It should acknowledge the issue is under investigation, state that you’re taking it seriously, and avoid speculation about cause or scope. Only your Incident Manager or a designated executive should approve the final version before it goes out internally or externally.

When you call your insurer and your attorney, expect them to ask for specifics: the time you first noticed the issue, which systems are affected, whether you have clean backups, and whether any customer or employee data appears to be exposed. Most cyber insurance policies also have strict notification windows, sometimes as short as 24 to 72 hours, so calling early protects your coverage.

For high-impact incidents involving theft, extortion, or major financial loss, report to the FBI’s Internet Crime Complaint Center (IC3) and consider notifying your local field office directly. CISA also accepts incident reports and can offer response resources for significant events.

Pro Tip: Never discuss incident details over an email account or messaging platform you suspect is compromised. Use personal phones or a separate, verified channel until you’ve confirmed which systems are safe.

How Often Should You Test Your Incident Response Plan?

A plan you’ve never rehearsed is a guess dressed up as a strategy. CISA recommends reviewing your IRP quarterly or after every incident and near miss, and running at least one full tabletop exercise per year.

Here’s a workable annual cadence:

1. Quarterly review: Confirm contact numbers are current, verify backups actually restore, and check that vendor service-level agreements still match what’s in your plan.
2. Annual tabletop exercise: Gather your core team for 30 to 90 minutes and walk through a realistic scenario, ransomware hitting your file server, or a compromised email account used to redirect a vendor payment, without touching real systems.
3. Post-exercise evaluation: Score the drill on three things: how fast people responded, whether contact information was accurate, and whether everyone understood who had decision authority.
4. Update and redistribute: Fix whatever the drill exposed, then make sure every copy of the plan, including the printed one, reflects the change.

NIST’s guidance on incident response points out that these drills routinely surface stale phone numbers, unclear authority, and recovery assumptions that don’t hold up in practice, problems you want to find on a Tuesday afternoon exercise, not during a live breach.

The Ransomware-Specific Response Sequence

Ransomware deserves its own short checklist because the sequence of actions differs from a garden-variety malware infection, and getting the order wrong can cost you both data and leverage. CISA’s StopRansomware guide lays out the priority order clearly:

• Isolate immediately. Disconnect infected systems from the network and from each other; ransomware spreads laterally fast.
• Take snapshots before you touch anything else. Preserving volatile evidence, memory state, running processes, matters for both insurance claims and any law enforcement investigation.
• Triage systems for restoration order. Identify which systems are critical to keep the business running and prioritize their recovery.
• Verify backups before restoring. A backup encrypted alongside your live systems does you no good.
• Notify in sequence: legal counsel first, your insurer next, then law enforcement and CISA through resources at stopransomware.gov.

Pro Tip: If the ransom note references a well-known threat actor group, share that detail with your insurer and counsel immediately; it can change both the negotiation approach and your legal reporting obligations.

Bring in an outside forensic or incident-response firm when the incident involves customer data exposure, a ransom demand, or any system your in-house team can’t confidently confirm is fully clean.

Build Your Own Template: Sections to Include

A workable IRP template doesn’t need to be complicated. It needs to be complete enough to act on and short enough that someone will actually read it during a crisis. Structure yours around these sections:

• Purpose and scope (what the plan covers, what it doesn’t)
• Authority statement (who can trigger the plan)
• One-hour checklist (the containment steps from earlier in this guide)
• Roles and responsibilities table
• Emergency contact table
• Incident triggers and severity classification
• Recovery priorities, ranked by business impact
• Review and testing schedule

If your business runs primarily in the cloud, add a section naming your cloud provider’s support contacts and their incident response SLA. If you’re still running on-premise servers, add specifics on physical access to server rooms and offline backup locations. A website security checklist covers the web-facing side of this preparation well if your business depends on an ecommerce site or customer portal.

Keep a printed copy in at least two physical locations, assign authority in writing rather than assuming everyone knows who’s in charge, and run a short walkthrough any time you make a major change to your systems, not just once a year.

Why Short, Practiced Plans Actually Get Used

Most of the incident response plans I’ve seen small businesses attempt fail for the same three reasons, and none of them are technical. The plan lives only on the network it’s supposed to protect, so it’s unreachable exactly when it’s needed. Nobody has clear authority to pull the trigger, so the first thirty minutes get lost in a debate about whether this “counts” as an incident. And the document itself runs fifteen or twenty pages, written for an audit, not for a manager standing in a server room at 2 a.m.

A two-to-four-page plan gets read. A named Incident Manager gets a decision made in minutes instead of hours. And treating a near miss, a suspicious login that turned out to be a false alarm, as a real drill exposes the same gaps a genuine breach would, without the damage. Businesses that run even one tabletop exercise a year consistently catch stale contact numbers and unclear authority before those gaps matter.

— Matt

Get Help Building and Testing Your Plan

Writing the plan is one project. Testing it, keeping backups verified, and making sure your systems can actually recover on the timeline your plan promises is an ongoing commitment most small teams don’t have the bandwidth to sustain alone. Some cybersecurity and compliance providers build ongoing capacity into their services, combining plan development with managed hosting, backup verification, and tabletop facilitation to keep an IRP from going stale.

An engagement typically starts with a working session to map your systems and assign roles, moves into drafting the plan itself, and can extend into a scheduled tabletop exercise or ongoing managed backups through Tatemweb’s hosting plans, which start at $41.99 a month for the Launch tier. If your business also carries HIPAA, CMMC, or PCI obligations, that compliance layer gets folded into the same plan rather than handled as a separate project. Explore the full range of cybersecurity and compliance services and schedule a consultation at 772-224-8118 to get your plan built, tested, and ready before you need it.

Where to Find the Official Templates

For the original government-issued guidance behind this article, start with CISA’s Cyber Guidance for Small Businesses and its IRP Basics PDF. For ransomware specifics, CISA’s stopransomware.gov hosts the full StopRansomware Guide, and NIST’s CSF 2.0 Community Profile covers the broader risk-management framework this plan structure is built on.

Sources

• Incident Response Plan (IRP) Basics (CISA)
• Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (NIST)

FAQ

What Should Be in an Incident Response Plan?

A small-business IRP should include a purpose and scope statement, named roles with clear authority, a one-hour containment checklist, an emergency contact table, incident classification guidelines, and a review schedule. CISA recommends keeping the whole document to 2 to 4 pages so it actually gets used during a crisis.

What Are the Six Phases of Incident Response?

The recognized model covers preparation, identification, containment, eradication, recovery, and lessons learned, a structure NIST aligns with its CSF 2.0 framework. Some frameworks split containment and eradication further, but these six stages cover the core actions any small business needs.

How Do I Create an Incident Response Plan for a Small Business?

Start with a one-hour checklist for immediate containment, then name an Incident Manager with clear authority to trigger the plan. Build out roles, a contact table, and recovery priorities using the CISA IRP Basics template as your starting structure, then test it with a tabletop exercise before treating it as finished.

How Often Should a Small Business Test Its Incident Response Plan?

Review the plan quarterly and after any incident or near miss, and run at least one full tabletop exercise annually. CISA’s guidance for small businesses treats this cadence as the minimum, not the ideal.

Can Tatemweb Help Build an Incident Response Plan?

Yes. Tatemweb works with Florida small businesses to draft incident response plans, run tabletop exercises, and provide managed backups and hosting that support recovery. Current service details and pricing are listed on the Tatemweb AI services page.

Recommended

• The Fastest Way for Small Businesses to Deploy AI Cybersecurity
• Cut PCI Work to a Few Hours: Reach SAQ A for Small Businesses
• Set Up Cloudflare in an Afternoon: 6 Steps for Small Businesses
• Cybersecurity Compliance for SMBs: 2026 Guide