Cyber Incident Response for Small Businesses

Incidents rarely start with an obvious alarm. Common early signs include:

• Suspicious emails, or someone reporting they clicked a link or entered details — see what to do after a phishing email.
• Compromised accounts: password changes you did not make, or messages sent that nobody wrote — see our hacked email account guide.
• Unusual sign-ins from unfamiliar locations, devices or times.
• Files that will not open or a ransom note — see ransomware response steps.
• A defaced, redirecting or flagged website — see what to do if your website is hacked.
• Malware alerts, disabled security software or a device behaving strangely.
• Suspected data exposure, or changed bank details on an invoice — see business email compromise and invoice fraud.

Treat a credible sign as an incident until you know otherwise. Starting the process early costs little; starting it late often costs evidence and time.

Containment limits further damage without destroying the record of what happened. The instinct to wipe a laptop or reboot a server is understandable, but isolating is usually safer and just as effective.

• Name one coordinator who makes decisions and keeps a written record.
• Disconnect affected devices from the network rather than wiping them.
• Change passwords for affected accounts from a clean device, and turn on multi-factor authentication.
• Contact your bank immediately if money or payment details may be involved.
• Bring in your IT provider or MSP with the facts gathered so far.

Evidence supports an insurance claim, a regulator conversation and a proper fix. Capture it before systems are changed:

• Screenshots of anything unusual: messages, alerts, ransom notes, sign-in warnings.
• Copies of suspicious emails, invoices or files involved.
• Logs from email, cloud services, security software and firewalls where available.
• Device details: which machine, which user, and when it was noticed.

Once the immediate risk is contained, work out the scope:

• What happened — the best current explanation, clearly marked as provisional.
• Which systems and accounts may be affected, and which are confirmed clean.
• When it started — often earlier than when it was noticed.
• Whether data may be involved — customer, staff, financial or confidential information. If so, our data breach response guide covers assessing affected data.
• Whether operations are affected — essential systems, manual fallbacks, and any customer or contractual commitments.

• Understand how the incident started before reconnecting or restoring systems.
• Restore from backups you have checked are recent, intact and pre-date the incident.
• Bring essential systems back first, in a deliberate order.
• Remove attacker access: unknown accounts, mail-forwarding rules, unfamiliar apps.
• Watch closely for repeat activity for some time after restoration.

A consistent written record is the single most useful thing a small business can keep. Record, from the start:

• An incident timeline: what was noticed, when, and by whom.
• Actions taken, and their results.
• People involved, inside and outside the business.
• Affected systems and accounts.
• Decisions made, who made them and why.

Agree who speaks to staff and customers, and keep messages factual. Staff need clear guidance on what not to click, forward or discuss externally.

Who does what

• Owner or manager — final calls on containment, communication and spend.
• IT provider or MSP — technical containment, checks and restores.
• Accountant or bookkeeper — unusual payments, invoices and cost impact.
• Insurer — cover, notification windows and approved suppliers.
• Bank — immediately, if payment details are exposed or money moved.

Depending on the incident, a business may have contractual, regulatory, insurer or law-enforcement reporting considerations. Examples include notifying an insurer within a policy window, telling customers under a contract, reporting fraud to the police, or considering whether a data-protection regulator — the ICO in the UK — needs to be told when personal data is involved.

Whether any of these apply depends on the circumstances and where you operate. This is general guidance, not legal advice; take advice where obligations are unclear.

• Lessons learned — a short review of what happened, what worked and what to change.
• Account security — multi-factor authentication everywhere, unique passwords, fewer administrator accounts.
• Monitoring — keep an eye on sign-ins, mail rules and alerts.
• Backup review — confirm backups are separate, recent and restorable.
• Security controls — updates, endpoint protection and access reviews.
• Staff awareness — share what happened and how to spot it next time.

1. One person named to coordinate the response.
2. Written timeline started before any changes are made.
3. Affected devices isolated from the network, not wiped.
4. Passwords changed from a clean device; multi-factor authentication on.
5. Bank contacted if money or payment details are involved.
6. Screenshots, emails and logs saved.
7. IT provider briefed with the facts.
8. Affected systems, accounts and data listed.
9. Insurer contacted; reporting considerations checked.
10. Recovery done from checked backups, followed by monitoring and a short review.

A free emergency check asks what happened and how urgent it is, then selects the relevant playbook and builds an Immediate Rescue Plan — so a business without a security team gets a sensible order of work instead of a blank page.

• Client Next Action gives the coordinator one clear step at a time.
• Evidence requests prompt the right screenshots and logs before they disappear, stored in a private case.
• Structured reports give you something to hand to an insurer, bank or authority without rewriting it from memory.
• Monitoring and closure keep the case open until follow-up checks pass.

See how the guided workflow fits together or compare the plans and the one-time Emergency Pass.

• Cyber Crisis Desk does not replace a qualified incident-response team for incidents that are severe, regulated or contested.
• We do not provide legal advice or make legal or regulatory determinations.
• We cannot access or change your systems; your IT provider or administrator carries out technical actions.
• We do not guarantee outcomes and never undertake tracing or offensive action.

We don't have an IT department at all. Can we still use this?

Yes. The workflow is built for businesses without an internal security team and explains each step in plain language, including where you may need an external IT provider.

Our IT provider is already handling it. What does Cyber Crisis Desk add?

It helps you coordinate everything around the technical fix — evidence, timeline, who to tell and reporting considerations — so nothing falls between the technical and business response.

How do we know if we need a specialist incident-response firm?

Signs include large volumes of sensitive data, attacker access you cannot contain, ransomware affecting core systems, or likely legal or regulatory exposure. Cyber Crisis Desk flags when a case looks like it needs that escalation.

What is the very first thing we should do?

Name one person to coordinate and start a written timeline before making changes. Containing the issue without destroying evidence usually matters more than speed alone.