Many business owners look back on a quiet year and think: nothing went wrong, so we’re probably okay. But “nothing happened” is not the same as “we were prepared”. Cyber incidents rarely announce themselves. They tend to appear during busy periods, after hours or when the person who usually handles IT is away.
When something does happen, the first hour matters most. Teams without a plan lose that time working out who to call, what to switch off and who is allowed to decide. An incident response plan settles those questions in advance.
This guide explains what an incident response plan is, what it should include for a small business, and gives you a simple template you can adapt.
What Is an Incident Response Plan?
An incident response plan is a short document that tells your team exactly what to do when a cyber incident is suspected: how to report it, who takes charge, how to contain the damage, who must be notified and how to get back to normal.
It works alongside your business continuity plan. The incident response plan covers the first hours and days of a security incident. The continuity plan covers keeping the business running during any kind of disruption.
What Counts as an Incident?
Staff should report anything on this list straight away, even if they’re not sure:
- A link clicked or attachment opened in a suspicious email
- A password entered on a page that didn’t look right
- An MFA approval request nobody triggered
- Files that won’t open, have strange names or have disappeared
- A ransom message on screen
- Emails sent from a staff account that the person didn’t send
- A lost or stolen laptop or phone
- Personal data sent to the wrong person or shared publicly
- Unusual pop-ups, slowness or software nobody installed
The 6 Phases of Incident Response
| Phase | What it means for an SME |
|---|---|
| 1. Prepare | Write the plan, name the roles, keep a contact list offline, and make sure backups and protection are in place |
| 2. Detect and report | Staff recognise the warning signs and report them immediately through one agreed channel |
| 3. Contain | Stop the spread: disconnect affected devices, reset compromised passwords, block suspicious accounts |
| 4. Assess and notify | Work out what happened and what data is affected, then decide who must be told |
| 5. Recover | Remove the threat, restore systems and data from clean backups, and confirm everything works |
| 6. Review | Hold a short no-blame review and update the plan, training and protection |
Incident Response Roles
In a small business, one person may hold more than one role. What matters is that everyone knows who does what before anything happens. For more on decision-making, see Cybersecurity Is a Leadership Responsibility.
| Role | Responsibility | Example |
|---|---|---|
| Incident lead | Takes charge, makes decisions and approves actions such as shutting down systems | Managing director or general manager |
| IT contact | Investigates, contains and restores systems | Internal IT person or your IT support provider |
| Communications | Updates staff, customers and suppliers using agreed messages | Office or operations manager |
| Data protection officer | Assesses whether personal data is affected and handles PDPA notification | Your appointed DPO |
| Backup person | Steps in if the lead is unavailable | A second director or senior manager |
The First-Hour Checklist
When an incident is reported, the incident lead works through these steps:
- Don’t panic, and don’t delete anything. Evidence may be needed later.
- Disconnect affected devices from the network by unplugging the cable or turning off Wi-Fi. Don’t switch them off unless your IT contact advises it.
- Call your IT contact using the phone number in your plan, not a number from a suspicious email.
- Reset passwords for any account that may be compromised, starting with email and admin accounts, and sign out all sessions.
- Write down what happened: who noticed what, at what time, and what has been done so far.
- Check that your backups are safe and disconnected from the affected systems.
- Tell staff what to do and what not to do, using a channel that isn’t affected, such as a WhatsApp group.
- Decide whether you need outside help from your IT provider, insurer or a specialist incident response team.
If the incident is ransomware, see our step-by-step guide on What to Do After a Ransomware Attack.
Quick Playbooks for Common Incidents
A staff member clicked a phishing link
Disconnect the device, reset the user’s password, sign out all their sessions and check their mailbox for new forwarding rules. Run a full scan with your endpoint security and watch the account for unusual activity.
An email account has been compromised
Reset the password and MFA, sign out all sessions, remove unknown forwarding rules and app permissions, and check sent items. Warn customers and suppliers who may have received scam emails, especially about bank detail changes.
Ransomware or encrypted files
Isolate affected devices immediately, protect your backups, call your IT contact and don’t contact the attackers or pay without professional and legal advice. Restore only from backups confirmed to be clean.
A lost or stolen laptop or phone
Report it at once. Your IT contact can lock or wipe the device remotely if it’s managed, reset the user’s passwords and check whether it contained personal data that needs to be assessed.
Personal data sent to the wrong person
Ask the recipient to delete it and confirm in writing, record what data was involved, and have your DPO assess whether it’s a notifiable data breach.
Who You May Need to Notify in Singapore
- The PDPC: under the PDPA, if a data breach involves personal data and is likely to cause significant harm, or affects 500 or more people, you must notify the Personal Data Protection Commission within 3 calendar days of assessing that it’s notifiable. Affected individuals must also be told if significant harm is likely.
- CSA: the Cyber Security Agency of Singapore offers support for organisations hit by cyber incidents, including a helpline for organisations.
- The police: make a police report for cyber crime such as ransomware, fraud or extortion.
- Your cyber insurer: most policies require you to notify them quickly, and some must approve which response providers you use.
- Customers, suppliers and partners: especially if their data is involved or scam emails were sent from your account. Check your contracts for notification terms.
This is general information, not legal advice. Check the PDPC’s current guidance or speak to a legal adviser about your specific situation.
Incident Response Plan Template
Copy these headings into a one or two page document. Keep a printed copy and a copy outside your main systems, so it’s available if email and files are down.
| Section | What to include |
|---|---|
| 1. Purpose | One line: how we respond to cyber incidents and data breaches |
| 2. How to report | The one channel staff use, and what to report |
| 3. Roles | Incident lead, IT contact, communications, DPO and backup person, with phone numbers |
| 4. Key contacts | IT support, internet provider, key software vendors, bank, insurer, legal adviser |
| 5. First-hour checklist | The steps above |
| 6. Playbooks | Short steps for phishing, compromised email, ransomware, lost devices and data sent in error |
| 7. Notification | When to notify the PDPC, police, insurer and customers, and who decides |
| 8. Message templates | Short holding messages for staff, customers and suppliers |
| 9. Incident log | Date, time, what happened, actions taken and by whom |
| 10. Review | Date of last test and next review |
Test the Plan Before You Need It
- Run a 30-minute tabletop exercise once a year: pick a scenario, such as “the finance manager’s email has been hacked”, and walk through the plan.
- Check every phone number in the plan still works.
- Make sure new managers know their role.
- Remind staff how to report, as part of regular staff awareness training.
- Update the plan after every real incident or near miss.
Preparation Makes Response Easier
The better your protection, the fewer incidents you face, and the easier the ones that do happen are to handle. The minimum security baseline covers the essentials. Acronis Endpoint Security detects and stops threats and gives your IT contact the information they need to investigate. Acronis Backup and Microsoft 365 Backup make sure you have clean data to restore. Managed IT support means someone is ready to respond when you call.
Eligible SMEs can get up to 50% grant support for Acronis Endpoint Security, Acronis Backup and Microsoft 365 Backup. See our EDGE grant guide.
Frequently Asked Questions
What is an incident response plan for a small business?
It’s a short document that sets out how staff report a suspected cyber incident, who takes charge, the first steps to contain it, who must be notified and how systems are recovered.
What should be in an incident response plan?
How to report, named roles and phone numbers, key external contacts, a first-hour checklist, short playbooks for common incidents, notification rules, message templates, an incident log and a review date.
Do I have to report a data breach in Singapore?
Under the PDPA, you must notify the PDPC within 3 calendar days of assessing that a breach is notifiable, meaning it’s likely to cause significant harm or affects 500 or more people. Check the PDPC’s guidance for details.
Should we switch off an infected computer?
Usually disconnect it from the network first and leave it on, so evidence isn’t lost. Follow your IT contact’s advice before switching it off.
How often should we test our incident response plan?
At least once a year with a short tabletop exercise, and update it after any real incident, staff change or new system.
Get Help Building Your Plan
WhatsApp Ostendo on +65 9457 3538 if you’d like help preparing an incident response plan, or if you think you have an incident now. You can also download our Cyber Resilience Checklist below.
Checklist: Seven Essentials for Cyber Resilience and IT Optimization
In today’s fast-paced digital landscape, SMBs face unique challenges in managing their IT infrastructure.
This checklist is designed to help you score and identify where you stand regarding cyber resilience and what areas in your organization lack expertise, resources and experience regarding IT support, and partnering with an MSP like us, is crucial.
Fill out the form to download the checklist today!
