You Need an Incident Response Plan Before You Need an Incident Response Plan

Nobody thinks they’re going to get breached. Then it happens in the middle of the night before a long weekend, half the team is unreachable, and suddenly you’re googling “what to do after ransomware attack” from your phone because your laptop is encrypted.

This isn’t a hypothetical. IBM’s 2025 Cost of a Data Breach report puts the average breach lifecycle at 241 days - that’s time to identify and contain. And IBM’s research has found year after year that organizations with a tested response plan spend less on every breach than those without one.

Let’s not be those companies.

The “we’ll figure it out” problem

Plenty of small businesses don’t have a written incident response plan at all. They’re winging it, and it shows.

Here’s what usually goes wrong when an org gets hit without a plan:

Panic-driven decisions. Someone pays the ransom within hours without consulting legal, insurance, or law enforcement. The Sophos State of Ransomware 2025 report found that 49% of attacked orgs paid up - and paying doesn’t guarantee recovery. You might get some data back. You might not. You’ve also just funded the next attack.

Evidence destruction. Well-meaning IT staff reboot servers, wipe machines, or start restoring from backups immediately. All of which can destroy volatile forensic evidence - system memory, log buffers, active connections. Without that evidence, figuring out how the attacker got in (and whether they’re still in) becomes a lot harder.

Communication chaos. No one knows who’s supposed to talk to customers, the board, regulators, or the press. Information leaks internally before facts are established. Someone emails something that waives legal privilege.

Missed deadlines. The clocks start sooner than people expect. GDPR gives you 72 hours from becoming aware of a personal data breach to notify your supervisory authority. US public companies must disclose a material cyber incident within four business days of deciding it’s material, and every US state has its own breach notification law. Miss those windows and a bad week turns into a regulatory problem.

The NIST framework (simplified)

NIST SP 800-61 has been the gold standard for IR since 2012. They updated it to Rev. 3 in April 2025 to align with the CSF 2.0, but the original four-phase model is still the clearest way to think about it:

1. Preparation - Build the plan, train the team, establish contacts
2. Detection & Analysis - Figure out what happened and how bad it is
3. Containment, Eradication & Recovery - Stop the bleeding, clean up, restore
4. Post-Incident Activity - Lessons learned, plan updates, regulatory reporting

Most orgs skip phase 1 entirely and try to improvise phases 2-3 during a crisis. That’s like building a fire escape while the building is on fire.

Your IR plan doesn’t need to be a novel

For an SMB, a one-page plan is better than a 50-page document nobody reads. Here’s the essentials:

Before anything happens:

• Write down who does what - who leads the response, who handles comms, who contacts legal
• Pre-identify your contacts: IT consultant or MSSP, legal counsel (ideally with cyber experience), your cyber insurance carrier’s hotline, a PR contact
• Draft template notifications for customers, partners, and employees - you’ll customize later but having a starting point saves critical time
• Keep an offline copy of the plan. If your network is encrypted, a plan on SharePoint isn’t helping anyone
• Test your backups. Actually restore from them. Regularly. Backups that don’t work aren’t backups

When it’s happening:

• Isolate affected systems from the network - but don’t power them off (you’ll lose volatile memory)
• Document everything as it happens: who, what, when, where
• Call legal early. Before you send any emails or make any statements. Privilege matters
• Contact your cyber insurance carrier per their policy requirements - most have a specific notification window
• Don’t communicate externally until you know the facts and legal has reviewed your messaging

After:

• Run a lessons-learned review within a week or two while it’s fresh
• Update the plan based on what you discovered
• Report to relevant authorities as required by your jurisdiction

Tabletop exercises: awkward but worth it

Here’s the thing about IR plans - you don’t know if they work until you test them. Tabletop exercises are basically group walkthroughs of a simulated incident. No systems involved, just your team sitting around a table (or a Zoom call) talking through “what would we do if…”

They feel a bit awkward the first time. But they consistently surface gaps that look obvious in hindsight: the contact list is outdated, nobody knows how to reach the insurance carrier after hours, two people think they’re in charge, nobody considered what happens if the breach hits during a holiday.

CISA offers free Tabletop Exercise Packages you can download and run yourself. No consultants needed to start.

The goal isn’t perfection - it’s finding the holes before an attacker does.

The numbers argument (for your boss)

If you need to justify the time investment to leadership:

• Average global breach cost: $4.44M (IBM, 2025)
• Average ransomware recovery cost (not counting the ransom itself): $1.53M (Sophos, 2025)
• Orgs that used security AI and automation extensively cut their breach lifecycle by 80 days and saved nearly $1.9M on average (IBM, 2025)

An IR plan costs you a few hours of prep and a quarterly review. Not having one costs… a lot more.