A cyberattack isn’t a question of if — it’s a question of when. Yet according to industry surveys, fewer than half of small and mid-sized businesses have a documented incident response plan. The businesses that recover quickly from ransomware, data breaches, and system compromises aren’t lucky — they’re prepared. They built their plan before they needed it.
An incident response plan (IRP) is a structured, documented set of procedures your organization follows when a cybersecurity event occurs. It defines who does what, when they do it, and how the business communicates — internally and externally — while containing the threat and restoring operations.
At COMNEXIA, we’ve spent over 35 years helping Atlanta-area businesses build resilient IT environments. The single biggest factor separating a manageable security event from a catastrophic one is whether the organization had a tested incident response plan in place before the crisis hit.
What Are the Key Components of an Incident Response Plan?
A complete incident response plan contains six core phases, originally defined by the NIST Computer Security Incident Handling Guide (SP 800-61). Every effective plan addresses each phase:
1. Preparation — The foundation. This includes security tools, monitoring systems, staff training, and the written plan itself. Preparation also means maintaining current asset inventories, network diagrams, and contact lists.
2. Identification — How you detect that something is wrong. This covers monitoring alerts, user reports, anomaly detection, and the criteria for declaring an incident versus a routine IT issue.
3. Containment — Stopping the spread. Short-term containment isolates affected systems immediately. Long-term containment applies temporary fixes so business can continue while you investigate.
4. Eradication — Removing the threat entirely. This means eliminating malware, closing exploited vulnerabilities, and removing unauthorized access.
5. Recovery — Restoring systems to normal operations. This includes restoring from backups, rebuilding compromised systems, and validating that the environment is clean before reconnecting.
6. Lessons Learned — The most-skipped and most-valuable phase. A post-incident review documents what happened, what worked, what failed, and what changes the plan needs.
Skipping any of these phases creates gaps that attackers exploit during subsequent incidents.
Who Should Be on an Incident Response Team?
An incident response team isn’t just IT staff. Effective response requires coordination across the entire organization. At minimum, your team should include:
- Incident Response Lead — A senior IT or security professional who coordinates the technical response and makes containment decisions.
- IT/Security Staff — The technical team performing investigation, containment, eradication, and recovery.
- Executive Sponsor — A C-level leader (CEO, COO, or CIO) authorized to make business decisions during the crisis, including whether to shut down systems, engage law enforcement, or approve expenditures.
- Legal Counsel — Advises on breach notification requirements, regulatory obligations, evidence preservation, and liability.
- Communications Lead — Manages internal employee communication, customer notifications, media inquiries, and public statements.
- HR Representative — Involved when insider threats are suspected or when employee actions contributed to the incident.
- External Partners — Your managed IT provider, cyber insurance carrier, and forensics firm should all be identified in advance with current contact information and contracts in place.
For small businesses without dedicated security staff, a managed service provider like COMNEXIA often serves as the technical backbone of the incident response team, providing 24/7 monitoring, forensic capability, and experienced incident management.
How Long Does It Take to Detect a Cyber Breach?
The industry average for breach detection — known as “dwell time” — has improved but remains sobering. IBM’s annual Cost of a Data Breach Report consistently shows that the average time to identify and contain a breach exceeds 250 days combined. Organizations with incident response plans and dedicated teams reduce that timeline significantly — by an average of over 50 days compared to those without.
That dwell time matters financially. The same IBM research shows that breaches identified and contained in under 200 days cost substantially less — often hundreds of thousands of dollars less — than those that drag on longer. Every day an attacker spends inside your network increases the scope of damage, the volume of exfiltrated data, and the cost of recovery.
An incident response plan shortens dwell time because it establishes clear detection criteria, escalation procedures, and response triggers. Your team isn’t figuring out what to do during the crisis — they’re executing a plan they’ve already practiced.
What Should a Small Business Include in Its Incident Response Plan?
You don’t need a 200-page document. For most small and mid-sized businesses, a practical incident response plan is 15–30 pages and covers:
Contact Lists and Escalation Procedures
Maintain a current list of every person and vendor involved in your response. Include personal cell phones, not just office numbers. When your email system is compromised, you need out-of-band communication channels — phone trees, personal email addresses, or a messaging platform like Signal.
Incident Classification Matrix
Define what constitutes a low, medium, high, and critical incident. A single phishing email that was reported and not clicked is low severity. Ransomware encrypting file shares is critical. Each severity level should trigger different response actions and notification timelines.
System and Data Inventory
You cannot protect what you don’t know you have. Document your critical systems, where sensitive data resides, which applications are business-critical, and what your recovery time objectives are for each. This inventory directly informs containment and recovery priorities.
Communication Templates
Pre-draft notification templates for employees, customers, regulators, and media. During a crisis, you won’t have time to write thoughtful communications from scratch. Templates ensure you communicate accurately and promptly while meeting regulatory deadlines.
Evidence Preservation Procedures
Document how to capture forensic images, preserve logs, and maintain chain of custody. Improper evidence handling can compromise insurance claims, legal proceedings, and regulatory investigations.
Recovery Procedures
Link your incident response plan to your disaster recovery and business continuity plans. Define the order in which systems are restored, who authorizes restoration, and how you validate system integrity before returning to production.
Does My Business Need an Incident Response Plan for Compliance?
Yes — and the list of regulations requiring incident response planning continues to grow.
FTC Safeguards Rule — As of June 2023, the updated Safeguards Rule requires financial institutions (broadly defined to include auto dealerships, mortgage brokers, tax preparers, and others) to maintain an incident response plan as part of their information security program. This is not optional.
HIPAA — Healthcare organizations and their business associates must have incident response procedures as part of their Security Rule compliance. Breach notification timelines are strict — 60 days for breaches affecting 500 or more individuals.
PCI DSS — Any business processing credit card payments must maintain an incident response plan under PCI DSS Requirement 12.10. Annual testing is required.
State Breach Notification Laws — All 50 U.S. states have data breach notification laws with varying requirements for timing, content, and recipients. Georgia’s breach notification statute (O.C.G.A. § 10-1-912) requires notification to affected individuals in the most expedient time possible.
Cyber Insurance — Increasingly, cyber insurance carriers require a documented and tested incident response plan as a condition of coverage. Some will deny claims if the insured organization lacked a plan at the time of the incident.
For businesses in regulated industries — especially automotive dealerships subject to the FTC Safeguards Rule — an incident response plan isn’t just good practice. It’s a legal requirement. COMNEXIA’s cybersecurity services include compliance-aligned incident response planning tailored to your industry’s specific requirements.
How Often Should You Test Your Incident Response Plan?
A plan that sits in a drawer is barely better than no plan at all. Testing transforms a document into a capability. Industry best practices recommend:
-
Tabletop exercises — At least twice per year. Gather your incident response team around a table (or video call) and walk through a realistic scenario. What if ransomware hits at 2 AM on a Saturday? What if a departing employee exfiltrates customer data? Tabletop exercises reveal gaps in communication, decision-making authority, and technical procedures without any risk to production systems.
-
Functional exercises — Annually. These involve actually executing parts of the plan — restoring from backups, activating communication trees, testing out-of-band channels. You want to discover that your backup restore process takes 14 hours during a test, not during a real incident.
-
Plan reviews — After every real incident, every significant IT infrastructure change, and at least annually. Staff turnover, new systems, changed vendors, and evolving threats all require plan updates.
-
After every real incident — The lessons learned phase should feed directly back into the plan. If your containment procedures were too slow, update them. If a key contact was unreachable, add backup contacts.
What Mistakes Do Businesses Make During a Cyber Incident?
Even organizations with plans make costly mistakes under pressure. The most common:
Panicking and wiping systems — Destroying evidence before forensic analysis makes it impossible to determine what was compromised, what data was exfiltrated, or how the attacker gained access. Always preserve evidence before eradicating.
Communicating too slowly — or too quickly — Delayed notification can violate regulations and erode customer trust. But premature public statements before you understand the scope can cause unnecessary panic and inaccurate reporting. Your plan should define who approves external communications and when.
Neglecting the supply chain — Your vendors, partners, and service providers may be affected or may have been the entry point. Incident response must include vendor notification and coordination.
Skipping the post-incident review — Under pressure to return to normal, organizations skip the lessons learned phase. This guarantees they’ll make the same mistakes next time.
Not involving legal counsel early enough — Attorney-client privilege can protect certain communications and investigation findings. Engaging legal counsel from the start — not after the fact — preserves this protection.
Frequently Asked Questions
How much does it cost to create an incident response plan? For small and mid-sized businesses, developing an incident response plan with a managed IT provider typically ranges from a few thousand dollars to the low tens of thousands, depending on complexity, compliance requirements, and the depth of testing included. The cost of not having one — measured in breach recovery expenses, regulatory fines, and lost business — is orders of magnitude higher.
Can I use a template for my incident response plan? Templates from NIST, CISA, and SANS provide excellent starting frameworks. However, an effective plan must be customized to your specific environment, systems, regulatory requirements, and team structure. A generic template that doesn’t reflect your actual infrastructure will fail under real conditions.
What’s the difference between an incident response plan and a disaster recovery plan? An incident response plan focuses specifically on cybersecurity events — detection, containment, and eradication of threats. A disaster recovery plan is broader, covering restoration of IT operations after any disruption (natural disaster, hardware failure, cyberattack). The two plans should be tightly integrated, with the IRP triggering DR procedures when systems need to be restored.
Do I need a separate incident response plan for each location? Not necessarily, but your plan must account for multi-location considerations — local network segments, on-site personnel, physical security, and location-specific systems. A single plan with location-specific appendices is usually more practical than maintaining separate documents.
How do I get started if I have no plan at all? Start with three steps: identify your critical systems and data, assemble your response team and contact list, and define your incident classification criteria. These three elements give you a functional foundation. Then engage an experienced IT partner like COMNEXIA to build out the full plan, align it with your compliance requirements, and run your first tabletop exercise.
Building an incident response plan isn’t glamorous work. It won’t make headlines or impress anyone at a conference. But when the call comes at 3 AM that your systems are encrypted and a ransom note is on every screen, the businesses that survive — financially and reputationally — are the ones that built their plan before they needed it.