Small Business Incident Response Guide: What to Do When You Are Hacked

Most small businesses have no IT staff, no security team and no plan, so when an account is hijacked, a supplier invoice is faked or files are encrypted, the owner has to make urgent decisions with no idea who to call or what to do first. The UK NCSC's small business response and recovery guidance breaks the job into five steps: prepare for incidents, identify what is happening, resolve the incident, report it to wider stakeholders, and learn from it. This guide turns those steps into practical actions for organisations of roughly 1 to 50 people, including sole traders, shops, practices and charities that rely on an IT provider or no one at all. It covers the one-page plan to write now, what to do in the first hour, who must be told (police, regulator, insurer, customers), and how to recover without being hit again. Prevention is covered in the Small Business Cybersecurity Basics Guide; this page is about the response.

Key takeaways

• Write a one-page plan before you need it. NCSC recommends key contacts with at least two ways to reach each, escalation criteria and a plan for when email and phones are down; CISA adds an offline address book.
• In a live attack, call for help immediately. In the UK, NCSC lists 0300 123 2040, available 24/7, for attacks in progress; in the US, CISA lists CISA, the local FBI field office, IC3 and the Secret Service as reporting routes.
• Isolate rather than switch off. CISA advises disconnecting affected devices from the network, and powering off only if you cannot disconnect, because powering off destroys evidence held in memory.
• Personal data breaches have a deadline. The ICO says that where a breach is likely to put people at risk, you must report it as soon as possible and, where feasible, within 72 hours, even if you are still investigating.
• Recover from clean backups, then fix the cause. Restoring onto systems the attacker still controls, or with the same stolen password, leads straight to a second incident.

What counts as an incident, and which ones hit small firms

NCSC describes a cyber incident as unauthorised access, or attempted access, to an organisation's IT systems, whether malicious (malware, ransomware, phishing) or accidental (damage from fire, flood or theft). NCSC's incident management guidance recommends starting with playbooks for the three to five most likely and highest-risk incident types. For most small firms these are:

Step 1: Prepare (do this now, in an afternoon)

NCSC's incident management guidance says a basic plan should include key contacts, escalation criteria, a simple flowchart covering the whole incident life cycle, at least one conference number for urgent calls and basic legal or regulatory guidance. CISA's small business guidance adds that leadership should approve the plan, that it should include an address book usable if the network is down, and that it should be reviewed regularly and after every incident or near miss. For a small business this fits on one page.

1. Contacts list, printed and stored off the network: your IT provider or "IT person", web host, bank fraud line, cyber insurer or broker, solicitor, accountant and key suppliers. NCSC advises two contact methods and two or more people for each contact, because people go on holiday.
2. Who decides: name the person who can authorise shutting systems down, spending money on outside help and talking to customers, and a deputy.
3. A list of what matters most: CISA's ransomware guidance recommends a predefined critical asset list. Write down the three to five systems the business cannot run without (for example email, the accounts package, the booking system, the card terminal) and which supplier runs each.
4. Admin account access: record where the administrator accounts for Microsoft 365 or Google Workspace, the domain name, the website and the bank are, and make sure more than one trusted person can reach them. Losing the only admin login is one of the most common reasons small firms cannot recover quickly. See the Small Business Identity and Access Security Guide.
5. Backups that are tested: CISA notes that many ransomware victims had no backups, or incomplete or damaged ones, and that restores took longer than expected. Keep at least one copy offline or separate from your main accounts, and test a restore. See the Backup Security and Immutable Backup Guide.
6. Check your insurance: if you have cyber cover, note the incident hotline, what it covers and whether you must use the insurer's response firm. See the Cyber Insurance Guide.
7. Choose an outside responder in advance: NCSC recommends that all UK organisations, including small local businesses, use an NCSC-assured Cyber Incident Response (CIR) provider, assured at Standard or Enhanced level. Pick one, or confirm your IT provider's capability, before an incident.

The Incident Response Contact and Call Tree Template and the Incident Response Plan Template can be cut down for a small firm.

Step 2: Identify what is happening (the first hour)

1. Do not panic and do not hide it: tell the decision-maker immediately. Speed matters more than certainty.
2. Write things down from the start: keep a simple log of what was noticed, when, by whom and what was done. Record decisions on paper or an unaffected device, as NCSC's ransomware guidance advises.
3. Work out the scope: which accounts, devices and systems are affected? Is personal data involved? Has money moved? CISA advises confirming what data is stored on affected systems and tracking which systems are unaffected.
4. Use a safe channel: if email may be compromised, use phone calls or a messaging group on personal phones. CISA recommends out-of-band communication so attackers do not learn they have been detected.
5. Judge the severity: NCSC's example severity matrix uses three factors: impact on staff, sensitivity of the data, and financial impact. A simple version for a small firm is below.

Step 3: Resolve the incident

Contain

• Isolate affected devices: unplug the network cable or turn off Wi-Fi on affected computers. CISA prefers network isolation to powering off, because powering off destroys evidence in memory; power off only if you cannot disconnect.
• Stop the money: if a payment was diverted, call the bank's fraud line straight away and ask for a recall.
• Lock accounts: reset passwords for affected accounts from a clean device, sign out all sessions, and remove unknown forwarding rules, inbox rules, mailbox delegates and connected apps. Reset administrator passwords first.
• Cut off outside access: disable remote access tools that were not set up by you or your IT provider, and change shared passwords used by suppliers.

Eradicate and recover

• Find how they got in before restoring: NCSC warns not to accept an attacker's account of how you were breached. A stolen password, an unpatched remote access service or a malicious attachment each needs a different fix.
• Clean or rebuild: wipe and reinstall infected devices rather than trying to clean them by hand.
• Restore in priority order: use your critical systems list. CISA advises restoring from offline backups and taking care not to reinfect clean systems.
• Turn on multi-factor authentication everywhere before reconnecting, starting with email and admin accounts. See the MFA Guide.

If it is ransomware

NCSC's guidance for organisations considering payment says the decision is the victim's, but warns that paying does not guarantee recovery, that promises to delete stolen data cannot be trusted, that payment to a sanctioned entity may be unlawful, and that the ICO does not treat paying a ransom as reducing risk to people or as a reason to reduce a penalty. Report the attack to your insurer promptly, check whether backups or free decryptors are available, and get expert help before deciding anything.

Step 4: Report to the right people

The ICO's breach reporting guidance was last updated in May 2025 and is under review following the Data (Use and Access) Act 2025, so check the current page when you report. See the Data Breach Notification Checklist and the UK GDPR and Data Protection Act 2018 Guide.

Step 5: Learn from it

CISA advises reviewing the plan after every incident or near miss, and documenting lessons learned. A small firm can do this in a one-hour meeting within two weeks of recovery.

1. What happened, in order: use the incident log to write a short timeline.
2. How they got in: the root cause, and what control would have stopped it (multi-factor authentication, patching, a payment call-back rule, backups).
3. What slowed you down: a missing contact, no admin access, untested backups, unclear decision-making.
4. Three changes with owners and dates: keep it short enough to finish.
5. Update the plan and contacts list, and consider Cyber Essentials certification to close common gaps.
6. Practise: CISA suggests regular tabletop exercises; for a small firm, a 30-minute walk-through of one scenario twice a year is enough. See the Tabletop Exercise Guide.

Where identity fits

In small firms, most incidents start and end with accounts: a stolen Microsoft 365 password, an admin account with no multi-factor authentication, a former employee's login still active, or an IT provider's shared remote access account used by an attacker. During recovery, treat every privileged login (cloud admin, domain registrar, website, bank, backup system and the IT provider's access) as compromised until reset, and remove any accounts that should no longer exist.

Measuring readiness

• Plan freshness: date the contacts list was last checked (target: within the last six months).
• Restore test: date of the last successful test restore and how long it took.
• MFA coverage: share of email and admin accounts with multi-factor authentication (target: 100%).
• Admin resilience: number of people who can reach each critical admin account (target: at least two).
• Time to contain: after an incident or exercise, time from discovery to isolating affected systems and resetting accounts.

Common failure patterns

• Switching everything off in panic: evidence is lost and recovery takes longer; isolate from the network instead.
• Emailing about the incident from the hacked mailbox: the attacker reads the response plan as it happens.
• Restoring before finding the cause: the attacker returns through the same stolen password or open remote access.
• Missing the ICO deadline while waiting for certainty: the ICO says to report what you know and add details later.
• Telling the insurer late: cover can be affected, and the insurer's responders arrive after key decisions are made.
• One person holds every admin password: when they are away or their account is hijacked, nobody can act.

Framework mapping

CIS Controls v8.1 Control 17 (Incident Response Management) covers the same ground for organisations ready for a more formal programme. See the CIS Control 17 Incident Response Management Guide.

Practitioner checklist

• Write a one-page plan with contacts (two people, two methods each), a decision-maker and deputy, and keep a printed copy.
• List the three to five systems the business cannot run without and who supports each.
• Make sure at least two trusted people can reach every admin account, with MFA turned on.
• Keep an offline or separate backup and test a restore at least twice a year.
• Note your insurer's incident line and pick an NCSC-assured CIR provider or confirm your IT provider's capability.
• In an incident: log actions, use a safe channel, isolate devices rather than powering off, and call the bank if money moved.
• Report live attacks on 0300 123 2040 (UK), assess ICO notification within 72 hours, and tell the insurer early.
• Find the root cause before restoring, then rebuild and restore from clean backups.
• Hold a one-hour lessons review and make three dated changes.

Standards and references

• National Cyber Security Centre: Small business guidance, response and recovery
• National Cyber Security Centre: Cyber incident response processes
• National Cyber Security Centre: Guidance for organisations considering payment in ransomware incidents
• National Cyber Security Centre: Cyber Incident Response scheme
• Information Commissioner's Office: Report a personal data breach
• GOV.UK: Report a cyber incident
• CISA: #StopRansomware Guide
• CISA: Cyber Guidance for Small Businesses

Related NHI Mgmt Group resources: Small Business Cybersecurity Basics Guide · Ransomware Basics for Small Businesses Guide · Incident Response Guide · Business Email Compromise Response Playbook · Cyber Insurance Guide