The First 24 Hours After a Breach: A Small Business Incident Response Plan
In the first 24 hours of a cyber incident, three things decide the outcome: containing the spread without destroying evidence, telling the right people early, and having decided the hard questions in advance. Most small businesses lose time arguing about who is in charge.
- Do not wipe or rebuild the first machine you find. Isolate it, because it holds the evidence that tells you how far the intruder got.
- Disconnect from the network, but do not power off. Shutting down destroys memory-resident evidence.
- Decide who declares an incident before you have one. Ambiguity about authority costs hours you cannot recover.
- Report it. CISA and the FBI's IC3 both take reports, and reporting is often expected by insurers and regulators.
- Extortion has shifted: threatening to damage your reputation is now the most common ransomware tactic, so a plan that only restores files is incomplete.
Why the first day decides the cost
Breach cost is mostly a function of dwell time and confusion. Organisations took a mean of 247 days to identify and contain a breach, a 2.5% increase that reversed a five-year decline, while the global average cost reached a record USD 4.99 million in 2026, which IBM frames as roughly USD 1,100 per hour.
Look at where that money goes and the case for preparation writes itself. Detection and escalation costs plus lost business made up 63% of total breach costs. Those are the categories a fast, organised first day compresses.
This guide is the sequence for that first day. It assumes you are a small business without a dedicated security team, which describes most organisations that get hit.
Hour zero: what not to do
The instinctive reactions are the damaging ones. Before anything else, stop the four moves that destroy your ability to understand what happened.
- Do not power off the machine. Pulling the plug destroys memory-resident evidence, which is often where the answer lives. Disconnect it from the network instead.
- Do not wipe and rebuild the first infected device. It is tempting because it restores that one person quickly. It also deletes the only record of how the intruder got in, which means you cannot tell whether they are still inside.
- Do not delete logs or clear alerts while tidying up. You are removing the timeline.
- Do not pay anything in the first hours. CISA's StopRansomware Guide advises organisations not to pay a ransom, on the basis that payment does not guarantee recovery and encourages further targeting.
The single most useful instruction to give staff in advance: if something looks wrong, unplug the network cable or turn off wifi, then stop touching it and call for help.
Hours one to four: contain without destroying
Containment is about limiting spread while preserving what you need to investigate. Work outward from the affected device.
- Isolate affected devices from the network but leave them powered on.
- Disable compromised accounts rather than deleting them, so the audit trail survives.
- Force a password reset on privileged accounts and confirm multi-factor authentication is enforced.
- Check whether your backups are reachable from the compromised network, and if so, disconnect them immediately.
- Preserve logs by exporting or extending retention before anything rolls over.
That backup step matters more than any other. 48% of all breaches involve ransomware, ransomware appeared in 39% of breached organisations, up from 34% the previous year, and operators routinely target backups first precisely because it removes your alternative to paying.
If your provider runs monitored detection, this is where automation earns its cost. Organisations using AI and automation extensively in security shortened breach times by 65 days and cut costs by USD 1.93 million.
Hours four to twelve: work out what actually happened
Two questions matter more than the rest: how did they get in, and what data did they reach. Everything downstream, including whether you have a legal notification duty, depends on the second one.
Start with the likely entry points rather than the exotic ones. 31% of breaches now start with the exploitation of software vulnerabilities, overtaking stolen credentials as the leading initial access vector, so an unpatched internet-facing system is the first place to look.
On data, be specific. Customer personal information was the most commonly stolen data type, appearing in 52% of breaches at an average of USD 192 per record. Establishing whether customer records were accessed, and roughly how many, is what your lawyer and insurer will ask first.
Write a running timeline as you go, with times and who did what. It feels bureaucratic during the event and it is invaluable afterwards, for the insurer, for any regulator, and for fixing the underlying cause. NIST SP 800-61 Revision 3 frames incident response as a continuous capability aligned to the Cybersecurity Framework rather than a one-off procedure, and the timeline is what feeds that learning loop.
Resist the pull to fix and move on before this is answered. If you restore from backup without establishing the entry point, you restore into the same weakness, and the second incident usually arrives faster than the first because the intruder already knows the route.
Hours twelve to twenty-four: notify deliberately
Notification is where small businesses most often get the sequencing wrong, either saying nothing for weeks or announcing something inaccurate on day one.
- Your insurer, early. Many cyber policies require prompt notification and some require you to use their approved responders. Calling late can affect cover.
- Legal counsel, before customer communications. Notification duties vary by jurisdiction and by data type.
- Law enforcement. CISA operates a central channel for reporting cyber incidents, and the FBI's Internet Crime Complaint Center accepts complaints from businesses of any size.
- Staff, with clear instructions on what to say and what not to say externally.
- Customers, when you know enough to be accurate. Say what you know, what you do not yet know, and when you will update.
Reputation is now an explicit part of the attack. Threatening brand reputation is now the most common ransomware extortion tactic, cited by 41% of organisations that suffered a ransomware incident. Attackers increasingly plan to contact your customers themselves, which is a strong argument for telling them first, on your terms.
The plan to write before you need it
An incident response plan for a small business does not need to be long. It needs to answer the questions people will otherwise argue about at 2am.
- Who declares an incident, by name, and who deputises when they are unreachable.
- Who can authorise disruptive action, such as taking a production system offline.
- The call sheet, printed. Phone numbers for your IT provider, insurer, legal counsel, law enforcement and leadership.
- Where the plan lives offline. A plan stored only in the system that just got encrypted is not a plan.
- How you communicate if email is unavailable. Agree the fallback channel in advance.
- What counts as recovered, so someone can declare the incident closed.
Then test it. A one-hour tabletop exercise, where you walk through a realistic scenario and find out who does not know their role, is the highest-value security hour most small businesses can spend. The NIST Small Business Cybersecurity Corner and CISA's Cross-Sector Cybersecurity Performance Goals both provide scaffolding if you want a starting structure.
Finally, ask your IT provider a direct question: during an incident, what do you do and what remains ours? Get it in writing before you need the answer.
FAQ
What should I do first when I discover a breach?
Isolate the affected device from the network but leave it powered on, then call your IT provider. Powering off destroys memory-resident evidence, and wiping the machine removes the only record of how the intruder got in and whether they are still inside.
Should I turn off the infected computer?
No. Disconnect it from the network instead, by unplugging the cable or disabling wifi. Shutting down destroys evidence held in memory that often explains how the attack started and what else it reached.
Should we pay a ransomware demand?
CISA's StopRansomware Guide advises against paying, on the basis that payment does not guarantee recovery and encourages further targeting. Decide your position in advance with your insurer and legal counsel rather than under pressure in the first hours.
Who do I have to report a cyber incident to?
That depends on your jurisdiction, sector and the data involved, so take legal advice. Practically, CISA operates a central channel for reporting cyber incidents and the FBI's IC3 accepts complaints from businesses of any size. Notify your insurer early, since many policies require it.
How long does it take to recover from a breach?
Longer than most expect. Organisations took a mean of 247 days to identify and contain a breach, and that figure rose 2.5% this year, reversing a five-year decline. Preparation is what compresses it, since detection and escalation plus lost business account for 63% of total cost.
What should a small business incident response plan contain?
Who declares an incident, who can authorise disruptive action, a printed call sheet, an offline copy of the plan, an agreed fallback communication channel, and a definition of what counts as recovered. Then test it with a one-hour tabletop exercise.
Sources
- NIST SP 800-61 Revision 3, Incident Response Recommendations and Considerations
- CISA, StopRansomware Guide
- CISA, Report a cyber issue
- FBI Internet Crime Complaint Center (IC3)
- IBM and Ponemon Institute, Cost of a Data Breach Report 2026
- Verizon, 2026 Data Breach Investigations Report
- NIST, Small Business Cybersecurity Corner
- CISA, Cross-Sector Cybersecurity Performance Goals
Best IT MSP is the independent, researched ranking of managed IT providers in every city. Compare on verified ratings, then ask each shortlisted provider to put their incident response role in writing.