Incident Response Plan for Small Businesses: Who Calls, What Shuts Off, and Who Talks When It Happens

It is 3:12 a.m. on a Tuesday. Your office manager's phone lights up with a message from an employee working a late shift: "All the files on the shared drive have weird extensions and there's a ransom note on the screen."

What happens in the next 30 minutes depends on one thing: whether your business already decided what to do, or is about to start deciding.

We spend most of our time on prevention. Monitoring, patching, segmentation, hardening. That is where the bulk of the work belongs. But after more than 10 years protecting 500+ businesses across Northeast Ohio, we have learned something we will not sugarcoat: strong prevention lowers your odds. It does not take them to zero. So this post is about the other half of the job, the part about people and decisions. It covers what your team does when something gets through anyway.

Why It Is "When," Not "If"

Every security program is a numbers game. Attackers only have to be right once. Your defenses have to be right every time, on every laptop, every account, every vendor connection, every day.

Even organizations with mature controls deal with incidents. That is why the U.S. National Institute of Standards and Technology treats incident response as a core part of cybersecurity risk management, not an afterthought. Its updated guidance, NIST SP 800-61 Revision 3, ties incident response directly to the NIST Cybersecurity Framework 2.0 functions, including Respond and Recover.

An "incident" is also broader than ransomware. It could be:

A compromised email account sending invoices to your customers
A lost laptop with patient, client, or student records
A former employee's login still active and being used
A vendor breach that exposes your data
Suspicious activity on a server at 2 a.m. that nobody can explain

The technology in each case is different. The decisions are almost identical: who gets called, what gets cut off, who decides, and who speaks.

The Real Problem at 3 A.M. Is Not Technical

When we walk into an incident at a business without a plan, the hardest part is rarely the malware. It is the hesitation.

Nobody knows whose job it is to call the IT provider.
The person who sees the problem is afraid to unplug anything without permission.
The owner is unreachable, and nobody else feels authorized.
Three different people tell three different customers three different stories.
The only copy of the emergency contact list lives on the server that just got encrypted.

Every minute spent figuring out who is in charge is a minute the problem spreads. A written plan exists to remove those minutes.

Step 1: Build Your Call Tree (and Put It on Paper)

Your call tree is the ordered list of who gets contacted, by whom, and how. Keep it short. Keep it specific. Include names and after-hours numbers, not job titles and main office lines.

The order we recommend

Internal incident lead. One person (plus a backup) who owns the response from the first call to the all-clear. This is often the owner, operations manager, or office manager.
Your IT partner. The team that can see your network, isolate systems, and start investigating. You need a 24/7 number, not a support email.
Your cyber insurer's incident hotline. Many policies expect early notification and may direct you to specific response vendors. Calling early protects your options. (Check your own policy wording now, not during the incident.)
Legal counsel. Ideally an attorney familiar with data breach and privacy obligations. Counsel helps you understand notification duties and how to communicate without creating unnecessary liability.
Leadership and key stakeholders. Partners, board members, or department heads who need to know, in the order they need to know.

Depending on the situation, law enforcement may come next. The FBI accepts cybercrime reports through the Internet Crime Complaint Center (IC3), and CISA accepts incident reports at cisa.gov/report.

Keep it offline

This is the detail most businesses miss. If your contact list only lives in email, a shared drive, or a phone system that depends on your network, you may not be able to reach it during the exact event you need it for.

Print the call tree and keep copies at the office and at the incident lead's home.
Store a copy on personal phones (not just work devices).
Review it every quarter. People change numbers, roles, and jobs.

Step 2: Decide What Gets Shut Off First

When something looks wrong, instinct says pull the plug. Resist the urge to power everything off. The goal in the first minutes is to stop the spread while preserving evidence.

CISA's #StopRansomware Guide recommends isolating impacted systems from the network immediately, and advises powering down devices only if you cannot disconnect them, because shutting down can destroy volatile evidence that investigators rely on.

The first-moves sequence

Isolate affected machines from the network. Unplug the network cable, disable Wi-Fi, or have your IT partner quarantine the device remotely. Leave it powered on.
Disable remote access. Cut VPN connections, remote desktop access, and third-party remote support tools until you know they are not the way in.
Reset compromised credentials. Start with any account that shows suspicious activity, then administrator and privileged accounts. Do the resets from a device you know is clean.
Preserve logs. Firewall, server, email, and cloud application logs tell the story of what happened. Make sure nobody wipes, reimages, or "cleans up" machines before they are reviewed.
Write everything down. Time, what was seen, who did what. A simple notepad timeline is invaluable later for your insurer, attorney, and investigators.

What comes later: restoring systems. Recovery from clean, verified backups is one important piece of getting back to business, but it comes after containment and investigation, not before. Restore too early and you may restore the attacker right along with your data.

Step 3: Give Someone the Authority to Pull the Plug

This is the single most valuable decision you can make in advance.

In plenty of small businesses, the person who notices a problem at night is a shift supervisor, a nurse, a staff accountant, or a facilities employee. If that person believes they need the owner's sign-off to disconnect a server, they will wait. And waiting is how one infected laptop becomes an encrypted network.

Write it down, explicitly

Your plan should name:

Who can order isolation and shutdown (for example: the incident lead, the backup lead, and your IT partner's on-call engineer)
What they can do without asking (disconnect devices, disable VPN, lock accounts, take a system offline)
What still requires leadership approval (contacting media, paying any vendor outside normal scope, notifying regulators)

The message to your team is simple: if you see something that looks like an attack, you are authorized to disconnect it and call. Nobody will be in trouble for acting fast. A false alarm costs a little downtime. Hesitation can cost far more.

Step 4: Decide Who Talks, and What They Say

Communication failures turn manageable incidents into reputation problems. Customers get conflicting answers. Staff post on social media. Someone guesses at the cause and is wrong.

One spokesperson

Pick one person to speak externally, with one backup. Everyone else routes questions to them. Internally, tell staff clearly: do not discuss the incident with customers, vendors, or online until the spokesperson has approved a message.

Know your audiences

Customers and clients: what is affected, what you are doing, when they will hear more
Staff: what to do, what not to say, how operations will continue
Insurer: facts and timeline, through the channel your policy specifies
Regulators: only with legal counsel involved

Notification rules are real and they have clocks. Ohio's data breach law, Ohio Revised Code 1349.19, generally requires notifying affected Ohio residents in the most expedient time possible and no later than 45 days after discovering a qualifying breach. Healthcare organizations covered by HIPAA have their own requirements under the HHS Breach Notification Rule, which sets a deadline of no later than 60 days after discovery for notifying affected individuals. Other industries, including financial services and higher education, may have additional obligations. This is exactly why counsel belongs on your call tree.

A holding statement you can adapt

Have a short, approved statement ready before you ever need it. Something like:

"We recently identified a technical issue affecting some of our systems. We took immediate steps to contain it and are working with our IT and security partners to investigate. Protecting our customers' information is our priority. We will share more information as soon as we have confirmed facts. Questions can be directed to [spokesperson name and contact]."

The rules for every message

No speculation. Do not name a cause, an attacker, or a scope until it is confirmed.
No minimizing. Avoid phrases like "no data was accessed" unless investigators have confirmed it.
Commit to updates. Say when people will hear from you next, then keep that promise.

The FTC's Data Breach Response guide for business is a solid plain-language reference for communication and notification steps.

Your One-Page Incident Response Plan Checklist

You do not need a 60-page binder. Grab a sheet of paper and fill this out today.

People

[ ] Incident lead: name, cell, home number
[ ] Backup incident lead: name, cell, home number
[ ] IT partner 24/7 line
[ ] Cyber insurer incident hotline and policy number
[ ] Legal counsel: name, after-hours number
[ ] Spokesperson and backup spokesperson
[ ] Leadership members to notify, in order

Authority

[ ] Names of people authorized to isolate systems without approval
[ ] Actions that require leadership sign-off
[ ] Statement to staff: "You are authorized to disconnect and call"

First moves

[ ] Isolate affected devices from the network (keep them powered on)
[ ] Disable VPN and remote access tools
[ ] Reset compromised and privileged credentials from a clean device
[ ] Preserve logs; no wiping or reimaging until reviewed
[ ] Start a written timeline

Communication

[ ] Approved holding statement on file
[ ] Staff instructions: route all questions to the spokesperson
[ ] Notification obligations reviewed with counsel (state, industry, contracts)

Logistics

[ ] Printed copies at the office and at the incident lead's home
[ ] Copies on personal phones
[ ] Quarterly review date on the calendar

One page. Clear names. Clear authority. That is what turns chaos into a procedure.

Run a 30-Minute Tabletop Exercise Once or Twice a Year

A plan nobody has practiced is a guess. A tabletop exercise is a guided conversation where your key people walk through a realistic scenario and say out loud what they would do.

CISA publishes free Tabletop Exercise Packages with scenarios you can borrow. You can also keep it simple:

A 30-minute format

Minutes 0 to 5: Read the scenario. Example: "Saturday, 11 p.m. Your accounting manager gets a call from a client asking why they received an invoice with new bank details from your email domain."
Minutes 5 to 20: Walk it through. Who gets the first call? Who decides to lock the account? Who calls the client back? What do they say?
Minutes 20 to 30: Capture gaps. Missing phone numbers, unclear authority, nobody knowing the insurer hotline. Assign a fix and a date for each.

Rotate scenarios: a lost laptop, a ransomware note, a compromised vendor account, a power event during an attack. Every exercise exposes something, and that is the point. You want to discover the gap in a conference room on a Thursday afternoon, not at 3 a.m.

If It Happens Anyway: What LNS Does

Prevention is our first job. When something gets through anyway, here is how we show up.

24/7 monitoring and rapid incident response

Our cybersecurity pillar is built around 24/7 anomaly detection, proactive monitoring, and rapid incident response. In many cases, we are the ones making the 3 a.m. call to you, because our monitoring flagged the activity first.

One unified team, one SLA, zero finger-pointing

During an incident, fragmented vendors are a liability. The internet provider blames the firewall vendor. The firewall vendor blames the help desk. The backup company waits for someone to open a ticket. We cover all six pillars (WAN connectivity, cybersecurity, network infrastructure, IT infrastructure, UPS backup, and backup and disaster recovery) under one SLA. One call reaches the team that can isolate the device, lock down remote access, review the firewall logs, and start the tested recovery playbook. No handoffs. No excuses.

A local team that knows your environment

We are an independently owned Northeast Ohio company, serving businesses from Cleveland and Akron to Canton and Youngstown. We have worked through power outages, ransomware, hardware failures, and vendor disasters. When your business has a crisis, you get a local team that already knows your network, not a stranger reading your file for the first time.

We can also help you build the one-page plan above, fill in the technical first moves, and facilitate your first tabletop exercise so your people walk out knowing exactly what to do.

Schedule Your Consultation

Do not wait for the 3 a.m. message to find out who is in charge. Let us help you turn "what do we do?" into a procedure your whole team knows.

Schedule Your Consultation with Local Network Solutions today. Email us at hello@localnetworksolutions.com or call (216) 658-6988. Complete IT infrastructure. Zero gaps. Zero excuses.

Incident Response Plan for Small Businesses: Who Calls, What Shuts Off, and Who Talks When It Happens