Incident Response for SMBs: Your 60-Minute Action Plan When Things Go Wrong

## When the Alarm Goes Off, Will Your Team Know What to Do? It's 2 PM on a Tuesday. An employee calls you in a panic: "I think I clicked something bad—my files are all scrambled and there's a ransom note on my screen." What happens next? For most small business owners, the honest answer is: *we'd figure it out as we go.* That improvised approach costs companies an average of **$200,000 per incident** in downtime, recovery costs, and lost business—and for many SMBs, it's enough to close the doors permanently. The good news: you don't need a 50-person security team or a six-figure budget to respond effectively to a cyberattack. You need a plan, practiced roles, and the right tools. This guide gives you all three. --- ## Why SMBs Are Prime Targets—and Why Most Aren't Ready Cybercriminals increasingly target small businesses precisely because they assume you're unprepared. According to CISA, SMBs account for more than 40% of all cyberattack victims, yet fewer than 1 in 3 have a documented incident response plan. The threat landscape has also shifted. Ransomware-as-a-service kits let low-skill attackers launch sophisticated campaigns. Business email compromise (BEC) scams impersonate executives to redirect wire transfers. Supply chain attacks compromise trusted vendors to reach their SMB customers. The question isn't whether you'll face an incident—it's whether you'll be ready when you do. --- ## The 6-Phase Incident Response Lifecycle (Adapted for SMBs) The NIST Cybersecurity Framework (updated in 2025 with SP 800-61 Revision 3) defines incident response as a continuous lifecycle, not a one-time checklist. Here's how to apply it at your scale: ### Phase 1: Preparation (Do This Now, Before Anything Happens) Preparation is the only phase you can complete before an attack. Everything else happens under pressure. **Your preparation checklist:** - **Document your critical assets.** What systems, data, and applications would cripple your business if they went down? List them, along with who owns each one. - **Assign four key roles:** Incident Coordinator (usually the owner or ops lead), Technical Responder (your IT person or MSP), Communications Lead (who talks to customers and regulators), and Documentation Lead (who keeps the incident log). - **Create an out-of-band communication channel.** If your email is compromised, you need another way to coordinate—a Signal group, a personal phone chain, or a dedicated Slack workspace. - **Know your legal obligations.** HIPAA requires breach notification within 60 days. PCI DSS mandates immediate notification to your payment processor. Know your deadlines before you need them. > **SMB Fortress Tool:** [Incident60](/products/incident60) gives you a pre-built 60-minute incident response framework with role assignments, communication templates, and a step-by-step playbook designed specifically for small business teams. ### Phase 2: Identification — Is This a Real Incident? Not every alert is an attack. A misconfigured firewall rule, a failed login from a traveling employee, or a software bug can all look alarming. Your job in this phase is to confirm whether you have a real security incident. **Signs you're dealing with a real incident:** - Files are encrypted or inaccessible - Unusual outbound network traffic at odd hours - Employees locked out of accounts they didn't change - Unexpected admin accounts appearing in your systems - A vendor or customer reports receiving suspicious emails from your domain **Immediate actions:** 1. Screenshot or photograph everything you see (don't just close the window) 2. Note the exact time and what triggered the alert 3. Notify your Incident Coordinator immediately—don't try to fix it alone > **SMB Fortress Tool:** [AdminShadow](/products/adminshadow) continuously monitors for unexpected privilege escalation and new admin accounts—one of the most reliable early indicators of a breach in progress. ### Phase 3: Containment — Stop the Bleeding Once you've confirmed an incident, your priority is preventing it from spreading. Speed matters here: ransomware can encrypt an entire network in under 45 minutes. **Short-term containment (first 15 minutes):** - Disconnect affected devices from the network (unplug the ethernet cable or disable WiFi—don't just shut down the machine, as this can destroy forensic evidence) - Revoke or reset credentials for any accounts that may be compromised - Block suspicious IP addresses at your firewall if your IT person can do so quickly **Longer-term containment:** - Isolate affected network segments - Preserve system images and logs before any cleanup begins - Engage your managed service provider or incident response retainer if you have one > **SMB Fortress Tool:** [Firewall Change Kit](/products/firewall-change-kit) helps you manage emergency firewall rule changes with confidence, even under pressure, with a structured change log that preserves your audit trail. ### Phase 4: Eradication — Remove the Threat Completely Containment stops the spread; eradication removes the root cause. This is where many SMBs make a critical mistake: they restore from backup without first confirming the attacker's access has been fully removed—and get reinfected within days. **Eradication steps:** - Identify and remove all malicious files, scripts, or backdoors - Patch the vulnerability that allowed the attacker in (unpatched software, weak credentials, misconfigured remote access) - Audit all user accounts and revoke any that shouldn't exist - Scan all systems—not just the ones you know were affected ### Phase 5: Recovery — Get Back to Business Safely Recovery is more than just restoring your data. It's about returning to normal operations with confidence that the threat is gone. **Recovery best practices:** - Restore from the most recent clean backup—and verify it actually works before you need it - Bring systems back online gradually, monitoring closely for any signs of recurring activity - Change all passwords and rotate API keys and credentials across your environment - Notify affected customers, partners, and regulators as required > **SMB Fortress Tool:** [BackupProof](/products/backupproof) verifies that your backups are actually restorable before a crisis hits. Paired with [Restore Drill](/products/restore-drill), you can practice the full recovery process so your team knows exactly what to do when it counts. ### Phase 6: Lessons Learned — Make the Next Incident Smaller Within two weeks of resolving an incident, hold a post-incident review. This isn't about blame—it's about making your defenses stronger. **Questions to answer:** - What was the initial attack vector? (Phishing email? Unpatched software? Stolen credentials?) - How long did it take to detect the incident? - What slowed down our response? - What would we do differently? Document your findings and update your incident response plan. The businesses that recover fastest from cyberattacks are the ones that treat every incident as a learning opportunity. --- ## The One Thing Most SMBs Skip: Testing Your Plan A plan that lives in a drawer is not a plan—it's a document. The only way to know if your incident response plan works is to practice it. **Run a tabletop exercise at least once a year.** Gather your incident response team, present a realistic scenario (e.g., "A ransomware note appeared on three workstations this morning"), and walk through your response step by step. You'll quickly discover gaps: Who has the firewall admin password? Where are the backup credentials stored? Does anyone know the breach notification deadline for your state? NIST recommends at least two tabletop exercises per year for organizations handling sensitive data. For most SMBs, even one annual exercise dramatically improves readiness. --- ## Your Incident Response Quick-Start Checklist Before you close this tab, take 10 minutes to do these three things: 1. **Write down your four incident response roles** and the name of the person filling each one 2. **Identify your most critical systems** and confirm you have recent, tested backups for each 3. **Save your IT provider's emergency contact number** somewhere that doesn't depend on your email or network being up Cybersecurity incidents are stressful, expensive, and disruptive—but they don't have to be catastrophic. With a documented plan, practiced roles, and the right tools in place, your business can weather an attack and come out stronger on the other side. --- *SMB Fortress provides purpose-built security tools for small and mid-sized businesses. Explore [Incident60](/products/incident60), [BackupProof](/products/backupproof), and [AdminShadow](/products/adminshadow) to start building your incident response capability today.*