Incident Response Plan: What to Do in the First Hour After a Cyberattack
Why Every Business Needs an Incident Response Plan
An incident response plan is simply a written answer to the question “what do we do if we get hacked?” Most small businesses don’t have one, and that’s understandable, since nobody likes planning for a bad day. The problem is that when a cyberattack actually happens, people panic, and panicked decisions made in the first hour are often the ones that turn a manageable problem into an expensive one.
The plan doesn’t need to be long or technical. A single page that says who to call, what to unplug, and what not to touch is enough to keep a scary moment from getting worse.
Signs Something Is Wrong
Sometimes it’s obvious, like a screen announcing your files have been locked and demanding payment. Other times it’s quieter. A client asks why you emailed them a strange invoice, an employee notices files with odd names, a computer suddenly runs very slowly, or someone realizes they typed their password into a login page that didn’t look quite right. Your team should know that any of these is worth reporting right away, and that reporting quickly is never going to get them in trouble.
The First Hour of Your Incident Response Plan
The first move is to call your IT provider before doing anything else. They’ll want to know what you saw and when, and they can start containing the problem while you focus on the business side. If a specific computer seems affected, disconnect it from the network by unplugging the network cable or turning off its Wi-Fi, although you should leave it powered on, since shutting it down can erase clues that help figure out what happened.
Just as important is what not to do. Don’t start deleting files, don’t try to clean things up yourself, and don’t pay a ransom or reply to an attacker without talking to your IT provider and your insurance company first. If an email account may have been taken over, change that password from a different, trusted device and let your IT provider check whether the attacker set up any forwarding rules to keep watching your mail.
Who Else Needs a Call
If you have cyber insurance, call them early. Many policies have a dedicated hotline and specific steps you’re expected to follow, and going off on your own can sometimes affect your coverage. If money was stolen through a fake payment request, call your bank immediately, since the chances of stopping a transfer drop quickly with time.
Reporting the attack helps too. You can report incidents to CISA and to the FBI’s Internet Crime Complaint Center, and CISA points out that when businesses share what happened, everyone ends up more secure. If client or customer information may have been exposed, there can also be legal notification requirements, which is a good time to bring in your attorney.
Keeping the Business Running
A good incident response plan also covers how you’ll keep serving customers while systems are down. CISA recommends that businesses relying on specialized technology make sure their team knows how to operate manually if needed. For a small office, that might mean having a printed list of key phone numbers, a way to take payments or orders on paper for a day, and a plan for how you’ll talk to clients if email is unavailable.
This is also where good backups pay for themselves. A business with tested backups can usually restore and get back to work, while a business without them is stuck choosing between losing data and negotiating with criminals.
Writing Your Incident Response Plan
Start with one page. List who on your team makes decisions during an incident, your IT provider’s number, your insurance hotline and policy number, your bank’s fraud line, and your attorney. Add the simple first steps from above, print a copy, and keep it somewhere you can reach even if every computer in the office is down. It fits naturally alongside the rest of your IT policy.
Glitch Technology helps clients put together an incident response plan that fits how their business actually works, and we’re the first call when something goes wrong. If you’d like help writing yours, reach out for a free assessment.
The worst time to figure out what to do during a cyberattack is in the middle of one. Glitch Technology provides managed IT services and computer support in Jacksonville, IL. We take full ownership of IT environments for small businesses and municipal organizations through proactive monitoring, preventative maintenance, and strategic planning.