It often begins with a detail that doesn't fit. A client replies to an invoice you never sent. Your card terminal slows to a crawl. A staff member is locked out because someone else logged in first. Small businesses rarely get a loud alarm — they get a nagging inconsistency. What you do in the next 48 hours usually decides whether a bad week becomes a business-ending one. Print this checklist, write your phone numbers on it, and keep it where the person on call can actually find it at 2 a.m.
Assign These Jobs Before You Need Them
An incident doesn't wait for a meeting. Decide now who leads the response, who talks to your lawyer and insurer, and who handles customers while everyone else is firefighting. In a small company that's usually two or three people, each with a named backup. The lead's job is to make decisions and keep a written record, not to fix servers.
Build a one-page contact list: lawyer, insurance broker, IT provider, bank fraud line, and your largest clients. Ask your IT provider up front whether they handle incident response or just day-to-day support. Plenty do only the latter, and you want to learn that on a calm Tuesday rather than mid-breach.
Contain the Damage Without Erasing the Evidence
If a machine is compromised, pull its network cable or disable its Wi-Fi, but leave it powered on. Shutting a computer down can empty the volatile memory that holds running processes, malware artifacts, and sometimes encryption keys — exactly what an investigator needs.
Then move to accounts. From a clean device, change passwords on email first, because every other reset link lands in that mailbox. Bank and administrative accounts come next. A password change alone is not enough: revoke active sessions and tokens, remove unfamiliar email forwarding rules and mailbox delegates, and shut off remote access you don't recognize. An attacker holding a live session can stay inside long after the password changes. And resist posting updates in a staff chat channel until you know which inboxes are safe.
Preserve Evidence Like Someone Will Read Your Notes
Assume an insurer, a lawyer, a forensic firm, or a regulator will review your records later. Photograph screens and error messages with a phone, and note the date and time. Export suspicious emails with full headers instead of forwarding them, which strips the routing data.
Ask your IT provider to preserve rather than clear logs — firewall, VPN, email, MFA, endpoint, and cloud audit logs often roll off automatically after a set number of days. Keep a running timeline in a shared document: who noticed what, when, who was told, what was decided. Don't let anyone "clean up" a machine before it has been imaged. The urge to restore normal service is strong; fight it for a few hours.
Know Who You Must Tell, and By When
Notification duties arrive from several directions, and they don't all say the same thing. Your own contracts are often the tightest: client agreements and payment processor terms sometimes require notice within 24 or 48 hours. Privacy laws add regulator and individual notifications, and the clocks differ — GDPR, for example, sets a 72-hour deadline for notifying the supervisory authority. US state breach laws generally call for notice without unreasonable delay, with details varying state to state. Healthcare, finance, and education carry extra sector rules.
Call your cyber insurer early. Many policies require you to use their panel of forensic and legal vendors, and picking your own can put coverage at risk. If money was stolen or you're being extorted, report it to law enforcement and keep the report number. This is general guidance rather than legal advice — the deadlines that apply to you depend on where you operate and what you've signed, so have a lawyer confirm them.
Talk to Customers Like Adults
The notice people actually read is the one written in plain sentences. Say what happened, what information was involved, what you've done so far, and what you still don't know. Skip "unauthorized access to certain data elements." Write "someone accessed names, addresses, and the last four digits of card numbers."
Give people something concrete: a phone number and an email address that a human answers, plus steps they can take. Say what you know and be honest about the gaps — a second update beats a first notice that turns out to be wrong. Prepare a short FAQ for staff so the front desk isn't inventing answers. If card data was involved, coordinate with your payment processor and bank before the notice goes out; they may have their own requirements.
The 15-Point Checklist
- Reach your incident lead by phone or another channel you trust — not through the email system that may be compromised.
- Write down the exact time you first became aware. Deadlines and contract clauses are measured from that moment.
- Disconnect affected devices from the network, but leave them powered on.
- Change passwords from a clean device, starting with email, then banking and admin accounts.
- Revoke active sessions, tokens, API keys, and remote access. Remove unfamiliar forwarding rules and mailbox delegates.
- Check your backups: intact, offline, restorable? Restore one file to prove it.
- Photograph screens and error messages; export suspicious emails with full headers.
- Preserve logs before they rotate — firewall, VPN, MFA, endpoint, and cloud audit.
- Start a written timeline: names, times, decisions.
- Call your cyber insurer and your lawyer before hiring a forensics firm.
- Report stolen funds or extortion to law enforcement and record the report number.
- Map your notification duties: state law, sector rules, client contracts, processor agreements.
- Draft the customer notice in plain language and have it reviewed before it goes out.
- Set one point of contact for customers and staff, with a script and an FAQ.
- Schedule the debrief within two weeks, while memories are still sharp.
Make It Real Before You Need It
An unread checklist is decoration. Print two copies, fill in the names and numbers by hand, and put one in the office and one wherever your on-call person keeps their keys. Then run a one-hour tabletop exercise once a year: pick a scenario, hand someone the checklist, and watch where it falls apart. You'll find the things that only surface under pressure — the insurer's after-hours number is wrong, nobody knows who can approve spending on forensics, the backup hasn't been tested since the server was replaced. Fix those on a quiet afternoon while the stakes are zero. When the real call comes, you want the only hard part to be the breach itself.
Photo: advogadoaguilar / Pixabay
