How to Prepare a Simple Cyber Incident Response Plan for Your SME

Most SMEs have some security protections in place, but few have agreed what happens when something goes wrong. When a phishing email succeeds or a laptop goes missing, the first hour matters. Staff who know who to call and what to do can limit disruption.

An incident response plan does not need to be a thick manual. For most SMEs, two or three pages covering the essentials is enough.

1. Define what counts as an incident

Give staff simple examples: a suspicious login alert, a clicked phishing link, a lost or stolen device, an unusual payment request, or systems behaving unexpectedly. Encourage early reporting — it is better to check a false alarm than to miss a real issue.

2. Name who does what

• The internal person who leads the response and makes decisions.
• Your IT support provider and security vendors, including after-hours contact details.
• Who communicates with staff, customers and partners.
• Who decides whether insurers, external advisers or authorities need to be involved.

3. Set out the first steps

Keep this to a short sequence staff can follow under pressure: report immediately, do not wipe or reset affected devices, disconnect from the network if advised, and change passwords when instructed. This preserves the information needed to understand what happened.

4. Plan for recovery

Confirm where backups are held, how quickly key systems can be restored and which systems take priority. A plan that assumes backups work, without ever testing them, is one of the most common gaps.

5. Note your reporting obligations

If personal data may have been affected, the business may need to assess the breach and notify the Personal Data Protection Commission (PDPC) and affected individuals within set timeframes. Cyber insurance policies often require prompt notification too.

6. Review after every incident

Once the situation is resolved, hold a short review covering what happened, what worked and what should change. Update the plan accordingly.

Keeping the plan usable

• Keep a printed or offline copy — it may be needed when systems are unavailable.
• Walk key staff through a simple scenario once a year.
• Update contact details whenever people or vendors change.

The takeaway: An incident response plan turns an uncertain situation into a coordinated one. The aim is not to predict every threat, but to make sure everyone knows their role when it counts.