Small business security
A one-page cyber incident plan for a small business
When something goes wrong, like a hacked mailbox, ransomware or a lost laptop, the first hour is often wasted working out who to call and what to do. A one-page plan written on a calm day saves that time. It doesn’t need to be long or formal. It needs to be printed, current and known.
The short version
Your plan should answer
- Who decides, and who do we call first?
- How do we contain the problem?
- How do we keep trading for a few days?
- Who do we need to tell, and by when?
Why a single page
Large organisations have long incident response plans. A small business needs something people will actually use under pressure: one page, printed, kept somewhere you can reach even if your computers and email aren’t working.
What to put on the page
1. Who’s in charge
Name the person who makes decisions during an incident, and a backup if they’re away.
2. Who to call
| Contact | Why | Number |
|---|---|---|
| IT provider or IT person | Technical response and recovery | Write it down |
| Cyber insurer | Many policies require early notice and provide incident responders | Policy number and claims line |
| Bank | Stop or recall payments, protect accounts | Business banking fraud line |
| Australian Cyber Security Hotline | Free 24/7 advice | 1300 CYBER1 (1300 292 371) |
| Lawyer or adviser | Legal and privacy obligations | Write it down |
| Key suppliers and customers | If they may be affected, or you need them to verify payments | List the main few |
3. First steps to contain it
Short instructions anyone in the business can follow:
- Disconnect affected computers from the network (unplug the cable, turn off Wi-Fi). Don’t switch them off or wipe them.
- Don’t pay anything, and don’t contact attackers.
- Change passwords for affected accounts from a clean device, and sign out all sessions.
- Write down what happened, when and what you’ve done.
4. How to keep trading
What can you do for a few days without your main systems? Think about taking orders by phone, paper invoices, a backup way to contact customers, and where a recent copy of key information is kept.
5. Where backups are and who can restore them
Note what’s backed up, where, and who has the access to restore it.
6. Who to tell
- Staff: what to say and not say, and who answers questions.
- Customers: if their information or payments may be affected.
- The OAIC and affected people: if it’s an eligible data breach under the Notifiable Data Breaches scheme. See reporting data breaches.
- The ASD: report cybercrime through ReportCyber. If your business has turnover above $3 million and makes a ransomware payment, it must be reported within 72 hours.
Store a copy offline
Keep a printed copy in the office and a copy on the decision-maker’s phone. If ransomware locks your files, the plan in a shared folder won’t help.
Test it in an hour
Once a year, sit down with the key people and talk through a scenario. Some to try:
- “The accounts person gets an email from a supplier changing their bank details, and pays $18,000.”
- “Every file on the shared drive has been renamed and there’s a ransom note.”
- “The owner’s laptop is stolen from their car.”
Ask: who do we call? What do we do first? What would we lose? Then fix the gaps you find.
Prevention that makes the plan easier
- Turn on MFA everywhere.
- Keep backups that attackers can’t delete, and test restoring.
- Keep devices updated.
- Have a written rule for verifying payment changes.
The ASD’s Essential Eight and small business handbook cover these in more detail.
Practise the plan
Incident practice in NovaSoft Labs runs your team through fictional incidents such as a changed supplier invoice. Each choice changes what happens next, and you finish with a debrief you can save.
Common questions
We’re a team of three. Do we really need this?
Yes, and it will be short. The value is in knowing who to call and what not to do in the first hour.
Should we pay a ransom if it comes to that?
That’s a decision for the business with expert and legal advice. The Australian Government advises against paying. See our ransomware guide.
How often should we update the plan?
Whenever contacts change, and at least once a year after your test.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.