When something goes wrong - a strange login alert, a customer reporting spam from your email, a website showing content you never published, or a screen demanding ransom - the first few hours are usually chaotic. People panic, delete things, restart computers and change random passwords. Some of those actions help; others destroy evidence or make recovery harder.
A simple incident response plan turns that chaos into a checklist. This guide covers what to prepare in advance and what to do in the first 24 hours. It is written for business owners and managers, not security specialists.
What counts as an incident
For a small or mid-sized business, an incident is any event that puts your data, systems, money or reputation at risk. Common examples:
- A business email or social media account is taken over
- Your website is defaced, redirects visitors or shows spam links
- Ransomware or other malware appears on an office computer
- A laptop or phone with business data is lost or stolen
- An employee acts on a fake payment or bank-change request
- Customer personal data is sent to the wrong person or exposed online
Prepare before anything happens
Most of the value of an incident plan comes from preparation. Spend an afternoon on these:
Contact list
Write down, on paper and in a shared document:
- Who leads the response internally (usually the owner or a senior manager)
- Your IT, website and hosting partners, with phone numbers
- Your bank's fraud contact
- Your legal adviser and chartered accountant
- Your cyber insurance provider, if you have a policy
Asset and access list
Know what you have and who controls it: domain and hosting accounts, email admin, website admin, social media accounts, payment gateways, cloud storage and key software. Keep admin credentials in a password manager with emergency access for a second trusted person.
Backups you have tested
Recovery depends on clean, recent backups that are stored separately from your main systems, with at least one copy offline or immutable.
Basic logging
Make sure login alerts and activity logs are enabled for email, website admin and cloud services. Logs help you understand what happened and when.
Hour 0 to 1: contain and stay calm
The goal of the first hour is to stop the damage spreading without destroying evidence.
- Do not panic or hide it. Tell the person leading the response immediately.
- Isolate affected devices. Disconnect an infected computer from the network - unplug the cable and turn off Wi-Fi - but leave it powered on if possible.
- Do not wipe, reinstall or delete files yet. That can remove evidence needed to understand the scope.
- Secure accounts from a clean device. Change passwords for affected accounts using a different, trusted device, and sign out all other sessions.
- Turn on multi-factor authentication if it was not already enabled.
- If money is involved, call your bank at once to try to stop or reverse transactions. For online financial fraud, also call the national cyber crime helpline 1930.
Hours 1 to 6: assess and inform
Now work out what happened and who needs to know.
- Bring in your IT or security partner. Share what you have observed, screenshots and the timeline so far.
- Check the scope. Which accounts, devices or systems are affected? Was any personal or financial data accessed?
- Review account settings for tampering. Attackers who take over email often add forwarding rules or recovery details. Your IT partner can check for these.
- Consider reporting obligations. CERT-In directions from 2022 require many organisations to report specified cyber incidents within six hours of noticing them. Check with your adviser whether this applies to you.
- Inform your insurer early if you have cyber cover - many policies require prompt notice.
- File a complaint on cybercrime.gov.in for fraud or other cyber crime.
Hours 6 to 24: recover and communicate
With the situation contained and understood, move to recovery.
- Remove the cause - for example, malicious files on the website, an unknown admin account, or a vulnerable plugin
- Patch and update the software or settings that allowed the incident
- Restore from clean backups where systems or data were damaged, after confirming the backup predates the incident
- Reset credentials broadly if there is any doubt about which passwords were exposed
- Monitor closely for signs of the attacker returning
Communicating honestly
If customers, suppliers or partners are affected, tell them clearly what happened, what you are doing and what they should do (such as ignoring emails that appear to come from you). The DPDP Act 2023 includes obligations to notify in the event of a personal data breach; your legal adviser can confirm what is required and when. Avoid speculation and never promise that "no data was affected" until you know.
Timeline summary
| Timeframe | Main goal | Key actions | Typical owner |
| --- | --- | --- | --- |
| Before | Be ready | Contact list, access list, tested backups, logging | Owner with IT partner |
| 0 - 1 hour | Contain | Isolate devices, secure accounts, call bank if money involved | Incident lead |
| 1 - 6 hours | Assess and inform | Involve IT or security partner, check scope, review reporting duties | Incident lead and IT partner |
| 6 - 24 hours | Recover and communicate | Remove cause, patch, restore, notify affected people | IT partner, owner for communication |
| After | Learn | Review, fix root causes, update plan | Owner |
After the first 24 hours: learn and improve
Once the immediate crisis is over, hold a short review within a week:
- What happened, and how did it get in?
- How was it discovered, and could it have been spotted sooner?
- What worked well in the response, and what did not?
- What changes will prevent it happening again?
Common outcomes are turning on MFA everywhere, tightening access, updating software more often, improving backups and training staff to recognise phishing. Our website maintenance and cloud and DevOps services cover many of these ongoing protections.
A one-page plan template
Your written plan can be this simple:
- Incident lead and backup person: names and phone numbers
- Who to call: IT partner, hosting, bank, legal adviser, insurer
- First steps: isolate, do not wipe, secure accounts from a clean device, call bank if money is involved
- Where things are: password manager, backup locations, asset list
- Reporting: CERT-In and DPDP considerations, cybercrime.gov.in and 1930
- Communication: who speaks to customers and staff
- Review: schedule a lessons-learned meeting
Print it and keep a copy outside your main systems.
What not to do during an incident
Well-meaning actions can make things worse. Avoid these:
- Do not wipe or reinstall devices straight away. Evidence of how the attacker got in may be lost, and the same weakness can be exploited again.
- Do not pay ransom demands on impulse. Paying does not guarantee recovery and may have legal implications. Speak to your security partner, legal adviser and insurer first.
- Do not use a possibly compromised device to change passwords. If malware is present, new passwords may be captured too.
- Do not communicate about the incident using the compromised account. Use phone calls or a separate, secure channel.
- Do not make public statements before you know the facts. Inaccurate statements are difficult to correct later.
- Do not blame the person who reported it. Fear of blame makes people hide problems next time.
Practise with a short tabletop exercise
Once a year, gather the people named in your plan for an hour and walk through a scenario, such as "the accounts email has been taken over and a supplier has just paid into a fraudulent account". Talk through who does what, who calls whom and where information is kept. These exercises reveal missing phone numbers, unclear responsibilities and outdated access lists - far better discovered in a meeting room than during a real incident.
Key takeaways
- Prepare contacts, an asset list and tested backups before you need them
- In the first hour, isolate affected devices and secure accounts without wiping evidence
- Call your bank and the 1930 helpline immediately if money is involved
- Involve your IT or security partner early and check reporting obligations
- Recover from clean backups, fix the root cause and communicate honestly
- Review every incident and update your plan
If you would like help writing an incident response plan or reviewing your readiness, book a free consultation. Our team can walk through your systems and help you prepare. Learn more about our cyber security services.
