How to Build an Incident Response Plan from Scratch

Why You Need an Incident Response Plan — Even If You're a Small Business

Cyberattacks aren’t just a problem for enterprises. In 2025, small and mid-sized businesses (SMBs) face the same threats—ransomware, phishing, insider data theft—as Fortune 500 companies, but with fewer resources to respond. That’s why having an Incident Response (IR) Plan is no longer optional.

An IR Plan is a clear, step-by-step guide your team follows when a cybersecurity incident happens. It can mean the difference between a minor disruption and a week-long business outage.

This guide will show you how to build your own plan—from scratch, without expensive consultants or unnecessary jargon.

What Is an Incident Response Plan?

An Incident Response Plan outlines how your organization detects, responds to, contains, and recovers from cybersecurity incidents. It answers:

• Who does what when something goes wrong?

• How do we assess the severity of an incident?

• What steps must we follow to restore normal operations?

For SMBs, a good IR plan is practical, clear, and easy to follow. It doesn't need to be 100 pages long. But it does need to be actionable.

Core Components of a Strong IR Plan

Whether you're a 5-person IT team or running security solo, your IR plan should include the following:

1. Roles & Responsibilities

Define who is responsible for:

• Identifying the incident

• Escalating the issue

• Making decisions (containment, recovery)

• Communicating internally and externally

Create a simple table:

2. Incident Types & Severity

Classify the types of incidents you may face:

Add severity levels (Low, Medium, High, Critical) based on impact.

3. Communication Protocols

• Internal: How and when to notify staff.

• External: If needed, how to notify clients, partners, or regulators.

• Media response: Who speaks for the company?

4. Containment & Recovery Procedures

How to isolate a threat and get back to business:

• Disconnect affected systems

• Re-image endpoints or servers

• Change credentials

• Restore from clean backups

• Monitor for re-infection

Step-by-Step: How to Build Your IR Plan from Scratch

🔹 Step 1: Define Your IR Team

Even if your company is small, define who’s responsible for:

• Detection

• Decision-making

• Recovery

• Communication

Assign backups in case someone is on vacation or unreachable.

🔹 Step 2: Identify Likely Threats

Don’t try to cover every possible cyberattack. Start by focusing on the 5 most likely scenarios:

• Ransomware

• Phishing emails

• Business email compromise

• Cloud account breaches (e.g. Microsoft 365, Google Workspace)

• Insider data loss (accidental or intentional)

Build your IR plan around these scenarios first.

🔹 Step 3: Create Simple Playbooks

A playbook is a checklist of actions for a specific incident.

Example: Ransomware Playbook

1. Isolate infected devices from the network

2. Notify the IR coordinator

3. Check backups for recent, clean versions

4. Collect system logs

5. Report to cyber insurance (if applicable)

6. Wipe and rebuild devices

7. Restore data from backups

8. Monitor endpoints for reinfection

Write playbooks in plain language. Make them accessible to both technical and non-technical team members.

🔹 Step 4: Establish Escalation & Reporting Rules

Create rules that help staff know when and how to escalate:

• What’s the difference between an IT issue and a security incident?

• When should they notify the IR lead?

• Who makes the call to involve external IT or law enforcement?

Provide examples:

• “If more than 10 users report phishing, escalate.”

• “If a file server is encrypted, escalate to ‘Critical’ immediately.”

🔹 Step 5: Document and Store Everything

Include:

• System logs

• User reports

• Email headers

• Screenshots

• Timeline of events

Use a shared folder (preferably secure/cloud-based) to store incident documents. These are essential for post-incident review, legal defense, and insurance claims.

🔹 Step 6: Define Recovery & Cleanup Procedures

After the threat is removed:

• Validate backups and restore systems

• Reset passwords organization-wide (if needed)

• Patch exploited vulnerabilities

• Perform a forensic review if feasible

Document lessons learned and create action items to improve future response.

Testing Your IR Plan

A plan you never test is a plan that will fail.

Easy Ways to Test Your Plan:

• Tabletop Exercises: Walk through a scenario with your team. Ask, “What would we do next?”

• Phishing Simulations: Test your team’s ability to report and escalate suspicious emails.

• Backups Test: Restore data from a backup on a test machine to confirm it works.

Testing Schedule:

• Quarterly: Run a tabletop scenario

• Annually: Full review of plan, roles, and updates

• After Every Major Incident: Post-mortem + improvement

❌ Common Mistakes to Avoid

• No plan at all — leads to chaos during real attacks

• Plan written once, never reviewed — quickly becomes outdated

• No assigned roles — people freeze or blame each other

• Overly complex plans — hard to follow in a crisis

• Ignoring non-technical stakeholders — comms, HR, and execs need clarity too

A Real-World Scenario: Ransomware Hits an SMB

Let’s say your bookkeeper clicks a phishing link.

Within minutes:

• File servers are encrypted

• A ransom note appears

• Staff can’t access payroll or invoices

Without an IR plan:

• Panic sets in

• Staff keeps rebooting infected machines

• No one knows who to call

With an IR plan:

• The bookkeeper knows to report immediately

• IR lead initiates ransomware playbook

• Infected systems are isolated

• Clean backups are restored

• Incident is logged and reviewed

Downtime is minimized. No payment is made. Trust is preserved.

---

📥 Bonus: Build Faster with Free Templates

You don’t need to start with a blank page.

Grab a copy of our SMB Security Policy Pack which includes:

• ✅ IR Plan Template

• ✅ Acceptable Use policy template

• ✅ Access Control policy template

• ✅ Password policy template

• ✅ Employee policy acknowledgement form

👉 Download Free Policies

---

Final Thoughts: Don’t Wait for a Crisis

If you're reading this before an incident happens—you're ahead of the curve.

Cyberattacks don’t wait. Whether you're a 10-person team or a regional business, having a clear, tested plan will save you hours of confusion, lost revenue, and reputation damage.

Start with what you have. Use this guide to assign roles, draft a few playbooks, and run a tabletop exercise. You can improve it over time—but doing nothing is the biggest risk of all.