Incident Response Plan Template for Small Business

Incident Response Plan (IRP) Template | Small Business Operations

1. Document Control Block

---

2. Executive Summary & Purpose

This document establishes the standardized framework for detecting, responding to, and recovering from cybersecurity or operational incidents. The purpose is to minimize system downtime, protect proprietary data, and maintain institutional integrity through structured, repeatable workflows.

---

3. Scope & Prerequisites

• Scope: Applies to all network assets, physical endpoints, and cloud infrastructure managed by the organization.
• Required Tools:
  • Incident Log (Shared encrypted spreadsheet/vault).
  • Communication platform (Out-of-band: Signal/Slack/Teams).
  • Endpoint Detection & Response (EDR) access.
  • Backup verification access (Offsite/Immutable).
• PPE/Hardware: Hardware-based MFA tokens (if applicable).

---

4. Roles & Responsibilities (RACI)

---

5. Step-by-Step Procedure

Phase I: Detection & Analysis

• Log incident time, symptoms, and potential impact.
• Determine scope: Is this a single workstation, a service outage, or a data breach?
• Categorize severity: Low (isolated), Medium (departmental), High (critical infrastructure).

Phase II: Containment

• Isolate affected hardware/accounts from the primary network.
• Change credentials for compromised admin/service accounts.
• Prevent further data egress/loss by disabling external port access if necessary.

Phase III: Eradication

• Identify root cause (e.g., malware, credential stuffing, misconfiguration).
• Patch vulnerabilities or wipe/re-image compromised assets.
• Scan clean assets for persistent threats.

Phase IV: Recovery & Restoration

• Restore services from the last verified, clean backup.
• Conduct performance testing to ensure systems are operational.
• Monitor logs for suspicious recurring activity for 72 hours.

Phase V: Post-Incident Activity

• Conduct a "Lessons Learned" review.
• Update documentation/SOPs based on failures identified.
• File regulatory reports if PII/PHI was involved.

---

6. Quality Assurance & Pro-Tips

• Pro-Tip 1: Always maintain an "Out-of-Band" communication channel. If your email/Slack is compromised, you need a pre-arranged secondary method (e.g., private Signal group).
• Pro-Tip 2: Do not rush to "wipe" a machine until the Incident Commander has verified that a forensic snapshot is not required for legal/insurance purposes.
• Metric Thresholds:
  • Time to Detection (TTD): < 2 hours.
  • Time to Containment (TTC): < 4 hours.

---

7. Frequently Asked Questions

Q: Should I pay a ransomware demand? A: No. Payment does not guarantee data recovery and marks your business as a high-value target for repeat attacks. Always restore from immutable backups.

Q: When should I notify external clients? A: Notify clients only after the Incident Commander and Legal Counsel have verified the breach scope. Premature notification leads to reputational damage; late notification leads to regulatory liability.

Q: How often should we test this plan? A: Conduct a "Tabletop Exercise" every 6 months. Simulate a scenario (e.g., Ransomware) and walk through the steps to identify gaps in your team’s readiness.

---

Authorized by: Julian Vance, Chief Architect, Template Registry