A suspicious email is opened, a staff member reports they cannot access a shared folder, or invoices begin leaving an unfamiliar mailbox. These are the moments when small business incident response matters. The quality of the first few decisions can limit disruption, protect client information and help your team return to normal work sooner.
For a business with 5 to 100 staff, an incident response plan does not need to be a large corporate document that no one reads. It needs to be clear, current and practical enough for people to use when they are under pressure.
What small business incident response means
Incident response is the organised process a business follows when technology, data or accounts may have been compromised or disrupted. It covers cyber incidents such as phishing, unauthorised Microsoft 365 logins, ransomware and lost devices, but it can also apply to an internet outage, failed server, accidental data deletion or a supplier system compromise.
The aim is not to make a problem disappear immediately. It is to make sensible decisions in the right order: contain the issue, understand what happened, restore services safely and learn from it.
That order matters. For example, if an employee’s email account has been taken over, immediately deleting messages may remove useful evidence. Leaving the account active while people investigate, however, may allow more fraudulent emails to be sent. A defined process helps balance those competing priorities.
The first hour: act calmly and preserve options
When an incident is suspected, staff should know who to contact and what not to do. This avoids well-meaning actions making the situation harder to investigate or recover from.
The first response will depend on the incident, but the following actions are generally sound:
- Record what was noticed, when it was noticed and who reported it. Screenshots, error messages, suspicious email addresses and affected device names can all be useful.
- Isolate affected devices from Wi-Fi and the network if malware is suspected. Do not switch them off unless advised, as this may remove information needed to investigate.
- Secure affected accounts by changing passwords, ending active sessions and checking multi-factor authentication settings. For a suspected email compromise, this may also mean reviewing inbox rules and delegated access.
- Contact the person responsible for IT support and the business decision-maker. If client data, financial information or critical systems could be involved, escalate early rather than waiting for certainty.
Staff should never feel they need proof before reporting something. A prompt report about a strange sign-in notification or unexpected payment request is often far more valuable than a delayed report after a problem has grown.
Build an incident response plan people can use
A useful plan is short enough to be practical but detailed enough to remove uncertainty. Keep it somewhere staff can access if email, shared drives or the business phone system are unavailable. A printed copy held by key managers is still worthwhile.
Assign clear responsibilities
Name a primary and backup contact for technology incidents, along with the business owner or manager who can make operational decisions. In a medical practice, legal firm or accounting business, you may also need a person responsible for privacy and client communications.
Be specific about who has authority to take systems offline, approve emergency spending, contact insurers and speak with affected clients. These decisions can be sensitive. Agreeing on them before an incident prevents confusion later.
Your IT provider should be included as an operational contact, not treated as the sole owner of the plan. They may lead technical containment and recovery, while your business decides how to prioritise services and communicate with staff, customers and suppliers.
Identify the systems that matter most
List the systems your business cannot operate without and place them in order of priority. This could include Microsoft 365 email, accounting software, practice management systems, job scheduling, payroll, point-of-sale systems, file storage and phones.
For each system, note who administers it, how it is accessed, whether multi-factor authentication is enabled and where its data is backed up. Include key suppliers and their support contact details. If one staff member holds all the knowledge about a system, that is a business risk worth addressing.
Recovery priorities vary. A construction business may need job management and mobile access restored first. A dental practice may prioritise patient records and appointment schedules. There is no universal order, which is why this part of the plan needs to reflect your actual operations.
Set communication rules
During an incident, people need reliable instructions. Decide in advance how you will communicate if email is unavailable, such as by mobile, a phone tree or a nominated messaging platform.
Prepare simple internal messages that explain what staff should do without speculation. For example: do not open unexpected attachments, do not reset passwords unless instructed, and direct client queries to one nominated person. Clear communication reduces the chance of staff sharing incomplete information or falling for a follow-up scam.
If personal information may have been exposed, the business may have privacy obligations. The correct response depends on the information involved, the likelihood of serious harm and the circumstances of the incident. Obtain appropriate legal, privacy and cyber insurance advice rather than assuming every incident requires the same notification process.
Preparation makes recovery less painful
An incident plan cannot compensate for poor day-to-day controls. The best response work begins before anything goes wrong.
Multi-factor authentication should protect email, cloud services, remote access and administrator accounts. Staff need regular, practical training on phishing, invoice fraud and password prompts, particularly people who handle payments or client records. Training should focus on real decisions staff face, not just a once-a-year compliance exercise.
Backups deserve similar attention. A backup is only helpful if it is protected from the same incident and can be restored within a timeframe the business can accept. Ask where backups are stored, whether they are isolated from production systems, how often they run and when restoration was last tested.
Keeping software, devices and security tools up to date also reduces risk. It is not glamorous work, but unattended updates, unsupported devices and shared administrator passwords create problems that are much harder to untangle during an incident.
Restore carefully, then investigate properly
The pressure to get people working again is understandable, especially for a busy office in Gosford, Newcastle or the Hunter. Restoring too quickly can reintroduce the same issue, though. Before reconnecting a device or account, confirm the original cause has been addressed and that access is secure.
Recovery may include rebuilding a compromised computer, restoring clean files, resetting passwords, removing malicious inbox rules and monitoring accounts for unusual activity. A good technical response also checks whether the incident affected other devices, users or cloud services, rather than assuming the first visible problem was the only one.
Once operations are stable, hold a short review. Ask what happened, what worked, where decisions were delayed and what should change. This is not about blaming the staff member who clicked a convincing email. It is about improving the system around them.
Document the timeline, systems affected, actions taken, costs and communication decisions. That record is useful for insurance discussions, privacy assessments and future planning. It also turns an unpleasant event into a practical improvement list.
Test the plan before you need it
A simple annual exercise can reveal gaps quickly. Walk through a realistic scenario with your managers and IT support: a staff member’s Microsoft 365 account has sent fraudulent payment emails, or a shared drive is unavailable on a Monday morning.
Talk through who receives the first report, how the affected account is secured, how clients are informed, which systems are restored first and where backup contact details are held. A 30-minute discussion is often enough to identify outdated contacts, unclear responsibilities or recovery assumptions that need attention.
For businesses without an internal IT team, a managed IT provider can help maintain these procedures, monitor systems and provide technical support when an issue occurs. The value is not merely having someone to call in an emergency. It is having systems, backups and access controls reviewed before an emergency tests them.
A calm, well-practised response will not prevent every incident. It will give your people a clear path through a difficult day, protect the relationships your business has worked hard to build and make the next decision easier.
