A small-business cyber incident plan people can actually use

Work through it in this order

1. 01

   Choose plausible scenarios

   Use email compromise, ransomware, lost device, supplier compromise or cloud outage according to the business.

2. 02

   Name decisions and owners

   Record who can isolate systems, stop payments, engage help, communicate and approve recovery trade-offs.

3. 03

   Build the first-hour card

   Include safe contact channels, actions to avoid, evidence notes and essential external contacts.

4. 04

   Run a facilitated exercise

   Reveal information in stages, capture assumptions and avoid turning it into a technical quiz.

5. 05

   Fund the improvements

   Assign owners and dates to the access, backup, supplier, communication and recovery gaps found.

6. 06

   Retest the hard decisions

   Run a shorter follow-up once corrective actions are complete, focusing on the hand-offs and decisions that failed in the first exercise.

Keep these points in view

• Technical containment and business continuity decisions must run together.
• Keep essential contacts and a clean copy of the plan available outside the affected environment.
• A tabletop is valuable when it exposes ownership and information gaps; a perfect script proves very little.