When a cyber attack hits, your business needs more than technical fixes. Staff need to know how to escalate the incident, decision-makers need accurate information, and IT teams need a clear process for containing the threat and restoring affected systems. A documented response plan brings these actions together and helps prevent confusion during a security emergency.
For UK small and medium-sized enterprises (SMEs), incident response preparation means accounting for the threats to affect daily operations, from phishing emails and compromised business accounts to ransomware, stolen credentials, supplier breaches and accidental data disclosure.
This article sets out how to build a cyber incident response plan for your business, organise responsibilities, manage an incident from detection through recovery, and use a practical checklist to prepare your team.
What Is a Cyber Incident Response Plan?
A cyber incident response plan is a documented procedure that explains how your business identifies, assesses, contains, reports and recovers from a cyber security incident. It assigns responsibilities, sets escalation rules and gives employees clear instructions when systems or information are compromised.
An incident response plan is different from a business continuity plan. The incident response plan deals with the security incident itself, including investigation, containment and remediation. Business continuity planning focuses on keeping essential services running, while disaster recovery covers the restoration of systems, applications and data. These plans need to work together.
A useful plan covers five core activities:
- Prepare: Identify critical systems, assign responsibilities, maintain contact details and test backups.
- Identify: Recognise suspicious activity, assess the impact and classify the incident.
- Contain and resolve: Limit further damage, investigate the cause and remove the threat.
- Report and communicate: Assess regulatory duties and inform relevant stakeholders.
- Recover and review: Restore services safely, document lessons and improve security controls.
Cyber Incident Response Plan Template for UK SMEs
Use the following template as a starting point. Replace the example wording and placeholders with your business details, actual contacts, systems and escalation arrangements. Keep the completed plan somewhere accessible if your email, network or normal document storage becomes unavailable.
Cyber Incident Response Plan
Editable planning worksheet for UK small businesses
- Business name
- Incident lead and deputy
- IT support / incident response provider
- Critical systems and backup locations
- Communications and reporting contacts
- Review date and plan owner
Copy plan worksheet
Complete the worksheet with verified business details. Do not put passwords, recovery keys or other secrets in the plan; record how authorised responders can access them securely.
1. Purpose and Scope
State which parts of your business the plan covers, including employees, contractors, devices, cloud services, business applications and third-party systems that support essential operations.
Template wording: “This plan defines how [Business Name] identifies, manages, reports and recovers from cyber security incidents affecting its systems, information, employees, customers or business operations. It applies to all staff and relevant third-party providers.”
Include the incident types your business is most likely to face, such as phishing, ransomware, compromised business email, unauthorised access, data loss and supplier security incidents.
2. Incident Response Roles and Responsibilities
Every business needs a clear owner for incident decisions, even if it does not have a dedicated security team. One person can perform several roles in a small organisation, but critical responsibilities need named owners and deputies.
| Role | Main responsibilities |
| Incident lead | Coordinates the response, maintains the incident log and escalates major decisions |
| Business owner or senior manager | Approves significant operational decisions, resource allocation and major communications |
| IT support or security specialist | Investigates the incident, contains threats, preserves technical evidence and supports recovery |
| Data protection lead or privacy adviser | Assesses personal data exposure and advises on notification duties |
| Communications lead | Coordinates accurate updates to staff, customers, suppliers and other stakeholders |
| External specialists | Provide incident response, legal, insurance or specialist technical support when needed |
For a small business, the owner might act as incident lead while an external IT provider handles technical containment. The plan must still identify who makes decisions if the owner is unavailable.
Record each person’s primary and backup contact details. Include out-of-hours arrangements and a secure alternative to company email, since an attacker could compromise the communication system itself.
3. Incident Severity and Escalation
Set criteria for deciding how urgently an incident needs attention. Your severity system should reflect the potential impact on operations, data, finances and customers rather than relying solely on the number of affected devices.
| Severity | Example | Response |
| Critical | Active ransomware, widespread compromise, major service outage or confirmed exposure of highly sensitive information | Activate the incident team immediately; involve senior management and specialist support |
| High | Compromised administrator account, suspected customer data theft or multiple affected systems | Escalate promptly; investigate and contain with technical support |
| Medium | A suspicious account login or malware detected on a limited, isolated device | Investigate promptly, contain where necessary and review for wider compromise |
| Low | A suspicious email reported before anyone interacts with it, with no evidence of compromise | Record, assess and take appropriate preventive action |
These are example categories, not universal severity thresholds. Define what each level means for your organisation and specify who has authority to shut down services, suspend accounts, approve emergency spending and contact external parties.
Escalate an incident when new evidence indicates greater impact. A suspicious email that initially appears low risk, for example, becomes a more serious incident if an employee enters their password and the account starts sending fraudulent messages.
4. Incident Identification and Initial Assessment
Employees need a simple reporting route and clear instructions about what to do when something looks wrong. They should not have to prove an attack has occurred before reporting it.
The initial assessment should establish:
- What happened and when it was discovered.
- Which devices, accounts, applications or services are affected.
- Whether the incident is still active.
- Whether personal, financial, customer or confidential business information could be exposed.
- Whether business operations, customer services or essential suppliers are affected.
- Which technical specialists and decision-makers need to be involved.
Keep an incident log from the beginning. Record confirmed findings, outstanding questions, decisions, actions, responsible people and timestamps. This record supports investigation, recovery, reporting and any later insurance or regulatory review.
5. Containment, Investigation and Recovery
Document the immediate actions authorised staff can take and the situations that require specialist guidance. Avoid a generic instruction to switch off every device or change every password, because the correct response depends on the type of incident.
For a compromised account, responders might revoke sessions, secure authentication and review administrator access. For ransomware, they might isolate affected systems and preserve evidence. For a suspected data breach, they need to establish which information was accessed, altered, lost or disclosed.
6. Reporting, Communication and Documentation
List the circumstances that trigger a legal, contractual or internal reporting assessment. The plan should identify who evaluates personal data breaches, who contacts the relevant authorities and who approves communications to customers and staff.
For UK businesses, this includes assessing the ICO reporting threshold under the UK GDPR, considering the NCSC’s cyber incident reporting service, checking relevant police reporting routes and reviewing sector-specific or contractual duties.
7. Post-Incident Review
After recovery, document the cause, impact, response effectiveness and outstanding risks. Identify what failed, which controls were missing, whether contact information was current and whether staff understood their responsibilities.
Assign corrective actions to named owners with completion dates. Update the incident plan, technical controls and staff training based on what the investigation reveals.
Free Cyber Incident Response Checklist for Small Businesses
Use this checklist to check whether your business has the essential arrangements in place before an incident occurs. It also works as a review tool when updating an existing plan.
SME readiness checklist
Preparation
- Named incident lead and deputy with current contact details
- IT support, cyber insurer and specialist response contacts recorded
- Critical systems, business data and key suppliers identified
- Backups maintained, and restoration tested
- Alternative communications available if email or business systems fail
- Incident severity levels and escalation authority documented
During an incident
- Incident reported, and response lead notified
- Severity assessed and response team activated
- Affected systems or accounts contained safely
- Evidence preserved, and incident log started
- Personal data exposure and business impact assessed
- Reporting obligations and deadlines reviewed
- Staff and affected stakeholders were informed where appropriate
Recovery and review
- Root cause investigated and attacker access removed
- Backups verified before restoration
- Critical services restored in a controlled order
- Systems monitored for signs of renewed compromise
- The incident report was completed, and evidence was retained securely
- Lessons documented and corrective actions assigned
- The plan is updated, and staff training or exercises are scheduled
How to Write a Cyber Incident Response Plan for Your Business
A useful incident response plan reflects how your business actually operates. A template provides the starting structure, but you need to adapt it to your systems, staffing, suppliers and regulatory responsibilities.
Step 1: Identify Your Critical Systems and Information
List the systems your business needs to operate, such as email, finance software, customer databases, file storage, payment processing and business-critical cloud services. Record where information is stored, who manages each system and how the business would operate if it became unavailable.
Prioritise systems based on business impact. A small online retailer, for example, might depend on its e-commerce platform, payment services and stock records, while a consultancy might rely on email, client documents and project management software.
Step 2: Assign Responsibilities and Emergency Contacts
Name the people responsible for decisions, technical response, data protection and communications. Include deputies and external providers so that the plan remains usable when someone is unavailable.
Verify contact details regularly. Store the plan and emergency contact list somewhere accessible without the company’s normal network or email system.
Step 3: Create Playbooks for Likely Incidents
A general response plan explains how incidents are managed. An incident playbook gives more specific instructions for a particular scenario.
Start with the incidents most relevant to your business:
- Phishing and compromised email: Account isolation, session revocation, authentication checks and review of suspicious messages.
- Ransomware or malware: System isolation, evidence preservation, specialist investigation and controlled recovery.
- Personal data breach: Data identification, risk assessment, reporting decisions and affected-person communications.
- Supplier or cloud compromise: Contact the provider, investigate access, assess dependencies and follow the agreed recovery arrangements.
- Fraudulent payment instructions: Contact the bank immediately through a verified channel, notify affected parties and preserve transaction evidence.
Step 4: Define Reporting and Decision Deadlines
Document who assesses an incident against legal and contractual requirements, who approves external communications and who tracks deadlines.
For personal data breaches, the UK GDPR’s 72-hour reporting rule applies where notification to the ICO is required. Other obligations depend on the incident, the sector and the contracts involved. The response plan needs to direct staff to assess these duties promptly rather than assume every cyber incident has the same deadline.
Step 5: Test the Plan and Keep It Current
A plan that has never been tested can fail when people need it most. Run a short tabletop exercise in which staff discuss how they would respond to a realistic scenario, such as a compromised email account or ransomware affecting shared files.
Review the plan after an exercise, significant business change, supplier change or real incident. Set a scheduled review at least annually, with more frequent checks for contact details and critical dependencies.
What Is the NCSC’s Guidance on Incident Response?
The National Cyber Security Centre provides UK organisations with practical guidance on preparing for, identifying, resolving and learning from cyber incidents. Its small-business response guidance is particularly relevant to SMEs that do not have a dedicated security operations team.
The guidance emphasises preparation before an incident happens. Businesses need to identify critical systems, maintain tested backups, assign responsibilities, establish contact arrangements and understand how to report an incident. During a real incident, they need to assess the impact, contain the threat, recover safely and communicate with relevant stakeholders.
Build a Cyber Incident Response Plan for Your UK Business
A strong cyber incident response plan helps your business respond to cyber attacks with speed, control and defined responsibilities. It sets out how employees report incidents, who leads the response, how threats are contained, and what steps the business takes to restore systems, protect data and meet reporting requirements.
For UK SMEs, preparation starts with a response plan that employees can follow when an incident occurs. Use the template and checklist above to allocate responsibilities, keep emergency contacts accessible, test backup systems and rehearse response procedures. Establish the relevant reporting requirements in advance to avoid confusion and meet applicable deadlines.
Cybersecurity Services UK helps businesses identify security gaps, assess incident response readiness and establish practical procedures for their IT environments. Put the right measures in place before an attack occurs so your team can act decisively, reduce operational disruption and manage recovery effectively.
FAQs
1. What should a cyber incident response plan include?
A cyber incident response plan should include emergency contacts, incident response roles, severity levels, escalation procedures, containment and recovery steps, reporting responsibilities, communication arrangements, and post-incident review procedures.
- Does a small business need a formal incident response plan?
A small business benefits from a documented plan even if it has no dedicated IT or cybersecurity team. A clear procedure helps employees report incidents quickly, identifies who makes important decisions and ensures external IT providers can be contacted without delay.
- What is an example of an incident response plan?
For a compromised business email account, the plan might require the employee to report the incident, the incident lead to activate the response process, and IT support to revoke unauthorised sessions, secure the account and investigate suspicious activity.
- Who is responsible for incident response in a small business?
The business owner or a designated incident lead usually coordinates the response. IT support handles technical investigation and containment, while the relevant privacy or legal adviser helps assess reporting obligations.
- How often should a cyber incident response plan be tested?
Review the plan at least annually and after major changes to systems, suppliers or business operations. Test it through tabletop exercises and, where appropriate, technical recovery exercises.