What should a small business incident response plan include?

The details

NIST SP 800-61 describes incident response as part of overall risk management, aligned with the NIST Cybersecurity Framework. For a small business, a practiced one-page plan beats a long document no one has read. Run a 30-minute tabletop exercise once a year using a realistic scenario such as invoice fraud or ransomware.

What to do

• Name an incident lead and a backup.
• List external contacts with phone numbers.
• Document how to isolate devices and restore backups.
• List notification duties (customers, regulators, insurer).
• Practice with a tabletop exercise each year.

Useful next reads and tools

• Investigating Suspicious Encoded PowerShell Execution · lab

Terms explained

Incident response

Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.

Business email compromise

Business email compromise (BEC) is fraud in which a criminal impersonates or takes over a trusted email account to trick an organization into sending money or sensitive data.

NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) 2.0 is voluntary guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

Ransomware

Ransomware is malware that encrypts or steals data and demands payment to restore access or prevent publication.

Sources

• NIST SP 800-61 Rev. 3 Incident Response
• NCSC Small Business Guide