We got a call at 6:47 AM on a Thursday. A medical billing company in Sandy - 35 employees, handles insurance claims processing for a dozen healthcare providers along the Wasatch Front. Their office manager arrived early and found a ransom note on her screen. Every shared drive was encrypted. The billing system was down. Patient data was involved, which meant HIPAA was in play.
The first question we asked: "Do you have an incident response plan?"
Silence. Then: "We have the employee handbook?"
That's not a plan. And this company isn't unusual. Fewer than 30% of small and mid-sized businesses have a documented incident response plan, according to the Ponemon Institute. Of those that do, fewer than half have tested it. So roughly 15% of SMBs have a tested, documented plan for what to do when things go sideways. The other 85% are going to figure it out in the middle of the crisis. Under pressure. With executives asking questions. With clients calling. With the clock ticking.
Why the First 60 Minutes Matter
In the first hour of a security incident, every decision is either containment or escalation. The right decisions limit the blast radius. The wrong decisions - or no decisions - let the damage spread.
Common mistakes in the first hour:
- Turning off affected machines. Seems logical, right? Except that volatile memory contains forensic evidence - running processes, network connections, encryption keys - that disappears when you power down. Disconnecting from the network? Yes. Powering off? Usually no.
- Logging into compromised accounts. If an email account is compromised and you log in to "check what happened," you've potentially exposed your own credentials to the attacker's session. You've also muddied the forensic timeline.
- Notifying everyone. The instinct is to send a company-wide email. But if email is compromised, the attacker sees your response in real time. Internal communication during an active incident should use an out-of-band channel - a phone call, a messaging platform the attacker doesn't have access to.
- Restoring from backup immediately. If you don't know how the attacker got in, restoring from backup and reconnecting systems gives them the same entry point. Restoration without remediation is just resetting the clock on the next attack.
An incident response plan eliminates the decision-making overhead in those critical minutes. The plan says who does what, in what order, and who makes the calls. Nobody has to think about process during a crisis because the process is already documented.
The Anatomy of an Incident Response Plan
Your plan doesn't need to be a 100-page document. It needs to be clear enough that someone at 6:47 AM on a Thursday, running on adrenaline, can follow it. Here are the essential components:
1. Roles and Responsibilities
Who is the incident commander? This is the person who makes decisions during the incident. Not the most senior person - the person best equipped to coordinate the response. Who handles technical containment? Who communicates with leadership? Who manages external communication? Who talks to the lawyers? Assign these roles before an incident happens.
For small businesses without a deep bench, the incident commander is often the IT provider (that's us, for our managed IT clients). But internal roles still need definition: someone needs to be the business-side decision maker, someone needs to manage client communication, and someone needs to authorize expenditures (incident response can get expensive fast).
2. Detection and Classification
Not every alert is an incident, and not every incident is a crisis. Your plan should define severity levels:
Severity 1 (Critical): Active data breach, ransomware, compromised systems with sensitive data exposure. All hands on deck. External IR team engaged.
Severity 2 (High): Confirmed compromise with contained scope. Single account breach, malware on isolated endpoint. Response team engaged, monitoring for escalation.
Severity 3 (Medium): Suspicious activity requiring investigation. Unusual login patterns, policy violations, potential phishing success. Investigation initiated, escalation if confirmed.
Severity 4 (Low): False positives, minor policy violations, informational alerts. Logged and reviewed in regular security review.
Classification determines the speed and scale of the response. A Severity 4 gets reviewed tomorrow. A Severity 1 gets everyone on a call in 15 minutes.
3. Containment Procedures
For each type of incident, what are the containment steps? Document them specifically:
Compromised email account:
- Reset the password immediately
- Revoke all active sessions and refresh tokens
- Audit and remove unrecognized mailbox rules (forwarding, deletion)
- Audit and revoke unrecognized OAuth app permissions
- Audit and remove unrecognized registered devices
- Review sign-in logs for the past 30 days
- Search for emails sent from the account during the compromise window
- Notify recipients of any suspicious emails sent from the account
Ransomware:
- Disconnect affected devices from the network (unplug Ethernet, disable Wi-Fi - do NOT power off)
- Identify the ransomware variant from the ransom note or encrypted file extensions
- Determine scope - which systems and file shares are affected
- Preserve evidence - screenshot ransom notes, document affected systems
- Engage external incident response team and cyber insurance carrier
- Do not communicate with the attacker without guidance from IR team and legal
- Begin backup assessment - identify most recent clean backup for each affected system
These checklists remove guesswork. A stressed-out admin at 6:47 AM follows the checklist. Step by step.
4. Communication Templates
You will need to communicate with several audiences during an incident, and crafting messages under pressure leads to mistakes - saying too much, saying too little, making promises you can't keep, or inadvertently admitting liability.
Pre-draft templates for:
- Executive leadership. "We have detected [type of incident]. Current status: [containment/investigation/recovery]. Estimated impact: [scope]. Next update at: [time]."
- Employees. "We are experiencing a security incident. Please [specific instructions]. Do not [specific warnings]. Updates will be provided via [channel]."
- Clients/customers. Have this template reviewed by legal before you need it. What you say to affected parties has legal and regulatory implications. Have it ready.
- Law enforcement. If the incident involves crime (ransomware, fraud, data theft), your plan should include FBI and local law enforcement contact information and a decision framework for when to engage them.
5. External Contacts
During an incident, you'll need to reach people quickly. Maintain a contact list - printed, not just digital - with:
- IT provider emergency line (our managed IT clients have 24/7 access)
- Cyber insurance policy number and claims phone number
- Legal counsel experienced in data breach (not your corporate attorney - a specialist)
- External incident response / forensics firm (your insurance carrier may have a preferred panel)
- FBI field office (Salt Lake City: 801-579-1400) and local law enforcement cybercrime unit
- Key vendor contacts for critical systems
This list should be on paper and stored in multiple locations. If your systems are encrypted by ransomware, you can't access a digital contact list stored on those systems.
Tabletop Exercises: Testing Without Consequences
A plan that hasn't been tested is a theory. Tabletop exercises are low-cost, low-disruption ways to test your plan. Gather the incident response team in a room (or a video call), present a scenario, and walk through the response step by step.
"It's Tuesday morning. An employee reports that they clicked a link in a phishing email and entered their Microsoft 365 credentials. The phishing site looked like a legitimate Microsoft login page. What do you do first? Who do you call? What do you check?"
Watch where people hesitate. Watch where there's disagreement about who does what. Watch where the plan has gaps. Those hesitations, disagreements, and gaps are what you fix before a real incident forces the issue.
We run tabletop exercises quarterly for our managed IT clients. Each exercise uses a different scenario - phishing, ransomware, insider threat, vendor compromise. After 30-60 minutes, the team has practiced making decisions under simulated pressure, and the plan gets updated based on what we learned. It's the cheapest security investment with the highest return.
Post-Incident Review
After the incident is resolved, conduct a blameless post-mortem. What happened? How did we detect it? How long did detection take? Did the plan work? Where did it break down? What do we change?
The post-mortem should produce specific action items with owners and deadlines. "Improve monitoring" isn't an action item. "Deploy mailbox rule alerting for external forwarding by November 15, owned by IT" is an action item.
Every incident is a learning opportunity. The businesses that get breached and come back stronger are the ones that treat incidents as data, not disasters. Document everything. Update the plan. Run another tabletop. Get better.
Part 5 will shift focus outward - to the vendors and suppliers in your environment and the risk they bring with them. Because your security posture isn't just about your own controls. It's about everyone who has access to your data. If you don't have an incident response plan or yours hasn't been tested, reach out. We'll help you build one that works when it matters.