--- title: How to Create an Incident Response Plan Template for a Small Business description: Learn how to create an Incident Response Plan template for your small business so your team can respond faster, limit disruption, and confidently recover. image: https://mightygrc.com/hubfs/How%20to%20Create%20the%20Template%20for%20an%20Incident%20Respone%20Plan%20for%20Small%20Business.%20MIGHTY%20GRC.png --- [Skip to content](https://mightygrc.com/mighty-blog/small-business-incident-response-plan#main-content) [![MIGHTY GRC company logo M](https://mightygrc.com/hs-fs/hubfs/Screenshot%202026-05-20%20at%2010.52.57%20AM.png?width=372&height=420&name=Screenshot%202026-05-20%20at%2010.52.57%20AM.png)Homepage](https://mightygrc.com/) - [Home](https://mightygrc.com) - Products - [PolicyPilot](https://mightygrc.com/products/policypilot) - RiskSnap (Coming Soon) - BudgetLens (Coming Soon) - Pricing - [SMB Pricing](https://mightygrc.com/policypilot-pricing) - [Partner Program](https://mightygrc.com/policypilot-partner-pricing) - Resources - [MIGHTY Blog](https://mightygrc.com/mighty-blog) - [SMB Policy Guide](https://mightygrc.com/small-business-policy-guide) - Company - [The MIGHTY Mission](https://mightygrc.com/about-mighty-grc) - [Contact](https://mightygrc.com/contact) - [Product Demo](https://mightygrc.com/policypilot-demo) - [GET A DEMO](https://mightygrc.com/policypilot-demo) LOG IN - [Home](https://mightygrc.com) - Products - [PolicyPilot](https://mightygrc.com/products/policypilot) - RiskSnap (Coming Soon) - BudgetLens (Coming Soon) - Pricing - [SMB Pricing](https://mightygrc.com/policypilot-pricing) - [Partner Program](https://mightygrc.com/policypilot-partner-pricing) - Resources - [MIGHTY Blog](https://mightygrc.com/mighty-blog) - [SMB Policy Guide](https://mightygrc.com/small-business-policy-guide) - Company - [The MIGHTY Mission](https://mightygrc.com/about-mighty-grc) - [Contact](https://mightygrc.com/contact) - [Product Demo](https://mightygrc.com/policypilot-demo) - [GET A DEMO](https://mightygrc.com/policypilot-demo) LOG IN ![Write your own Incident Response Plan Template for your SMB with MIGHTY GRC](https://mightygrc.com/hs-fs/hubfs/How%20to%20Create%20the%20Template%20for%20an%20Incident%20Respone%20Plan%20for%20Small%20Business.%20MIGHTY%20GRC.png?width=2368&height=1332&name=How%20to%20Create%20the%20Template%20for%20an%20Incident%20Respone%20Plan%20for%20Small%20Business.%20MIGHTY%20GRC.png) Small Business Policies DIY Policy Programs Incident Response Plan # How to Create an Incident Response Plan Template for a Small Business ![Michael Wallace, MIGHTY CoFounder & CEO](https://mightygrc.com/hs-fs/hubfs/Michael%20Wallace%20Author%20Icon.%20MIGHTY%20GRC.png?width=48&height=48&name=Michael%20Wallace%20Author%20Icon.%20MIGHTY%20GRC.png) Michael Wallace, MIGHTY CoFounder & CEO October 14, 2026 Cybersecurity incidents don't always arrive with flashing warning signs. An employee might click a phishing link. A laptop could be lost or stolen. Someone might notice an unfamiliar login to their account. Sensitive information could accidentally be shared with the wrong person. Or your team could suddenly discover that an important system has been compromised. In that moment, one of the most valuable things your business can have is a clear answer to a simple question: **What do we do next?** An Incident Response Plan answers that question. You can't predict exactly what a cybersecurity incident will look like or when one might happen. But you can make many of the decisions about how you'll respond before you're under pressure to make them. ![MIGHTY GRC Quote for Small Business: You can make many of the decisions about how you'll respond before you're under pressure to make them.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **You can make many of the decisions about how you'll respond to an event before you're under pressure to make them.** Who should employees contact? Who takes the lead? When should you call your MSP or cybersecurity provider? How will you determine what's affected? Who has authority to make important decisions? How will you communicate if your normal systems aren't available? And how will you know when it's safe to return to normal? A good Incident Response Plan helps your team spend less time figuring out what to do and more time actually responding. ## What is an Incident Response Plan? An Incident Response Plan is a documented process for how your business will identify, respond to, manage, and recover from a cybersecurity incident. For a small business, it doesn't need to be a massive technical document filled with cybersecurity terminology. It needs to be **clear, practical, and actionable.** Your plan should help your team understand: - What could qualify as a cybersecurity incident - What employees should do when they notice something suspicious - Who needs to be contacted - Who is responsible for coordinating the response - How you'll assess what happened and what may be affected - How you'll contain the incident and prevent additional damage - Who may need to be notified - How you'll recover affected systems and return to normal operations - What you'll document and learn afterward Some of those decisions will belong to your team. Others may require help from your MSP, cybersecurity provider, insurance carrier, legal counsel, or other experts. Your job isn't to become a cybersecurity expert. It's to make sure your business knows what to do and who to turn to when expertise is needed. ![MIGHTY Mindset: Preparation turns reaction into response. And you don't need a master's in security to get prepared with an Incident Response Plan](https://mightygrc.com/hs-fs/hubfs/MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png?width=791&height=397&name=MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png) ### Preparation turns reaction into response. **And you don't need a master's in security to get prepared.** The goal isn't to anticipate every possible cybersecurity incident, or even to become an expert in security. It's to give your team a clear place to start when a security event occurs, including when and how to bring in expert support and a shared process for making good decisions when something unexpected happens. Why? **Because preparation creates resilience.** [Explore business resilience strategies for SMBs](https://mightygrc.com/mighty-blog/small-business-resilience-strategies)   ## What counts as a cybersecurity incident for an SMB? When you hear *cybersecurity incident*, it's easy to picture the extreme examples: ransomware, a major data breach, or an attacker taking down an entire network. Those certainly count. But an incident doesn't have to make the news to matter to your business. It could be: - An employee clicking a phishing link or opening a suspicious attachment - A compromised email or business account - An unexpected multi-factor authentication request - A lost or stolen laptop or phone - Malware detected on a device - Sensitive information sent to the wrong person - An employee account being accessed after they leave the company - An unfamiliar login from an unexpected location - Files suddenly becoming encrypted, deleted, or inaccessible - Suspicious activity in a financial or payment account - A vendor notifying you that your information may have been exposed - An employee realizing they entered a password into a fraudulent website And here's a critical point that small business leaders often overlook: **Something suspicious doesn't have to be a *confirmed* cyberattack before your team reports it.** Employees shouldn't be responsible for determining whether something is *really* a cybersecurity incident before asking for help. Their job is to recognize when something doesn't look right and know what to do next. ![MIGHTY GRC Quote for Small Business: Employees shouldn't be responsible for determining whether something is really a cybersecurity incident before asking for help.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **Employees shouldn't be responsible for determining whether something is *really* a cybersecurity incident before asking for help.** Your incident response process can determine what happens from there. ![MIGHTY Mindset: Make reporting cybersecurity events easy for your small team](https://mightygrc.com/hs-fs/hubfs/MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png?width=791&height=397&name=MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png) ### Make reporting easy. **Report, *then confirm.*** Make that your company motto at your next retreat or fireside chat. You'd rather have an employee report something that turns out to be harmless than stay quiet about something important because they weren't sure it was serious enough. Create a culture where raising a hand early is considered good judgment, not an overreaction.   ## Incident Response vs. Business Continuity vs. Disaster Recovery These plans work together, but they answer different questions and may apply to different situations. **Incident Response:** *A cybersecurity event may have happened. How do we investigate, contain it, make the right decisions, and coordinate our response?* **Business Continuity:** *Our normal way of working with our team and/or customers has been disrupted. How do we keep the most important parts of the business moving?* **Disaster Recovery:** *Technology or data is unavailable or damaged. How do we restore it and normal daily operations?* A cybersecurity incident may eventually activate all three. For example, imagine an employee discovers files on a company system have suddenly been encrypted. Your **Incident Response Plan** helps your team determine what happened, who needs to be involved, what should be contained, and what actions should be taken to mitigate any impact from the security event. Your **Business Continuity Plan** helps employees continue critical work while the system is unavailable. Your **Disaster Recovery Plan** helps restore the affected technology and data once it is safe to do so. ### Already working on Business Continuity and Disaster Recovery Plans? Incident response is only one part of preparing your business for the unexpected. If you haven’t built your other plans yet, we’ve created step-by-step MIGHTY guides to help. **![How to write a Business Continuity Plan for a small business](https://mightygrc.com/hs-fs/hubfs/Writing%20a%20DIY%20Policy%20Icon.%20MIGHTY%20GRC%20for%20Small%20Business.png?width=42&height=42&name=Writing%20a%20DIY%20Policy%20Icon.%20MIGHTY%20GRC%20for%20Small%20Business.png)[How to Create a Business Continuity Plan →](https://mightygrc.com/mighty-blog/small-business-continuity-plan)** Learn how to identify your critical business functions, understand what they depend on, and create Plan B (and sometimes Plan C) for keeping important work moving when normal operations are disrupted in your small or midsized business. **![How to write a Disaster Recovery Plan for a small business](https://mightygrc.com/hs-fs/hubfs/Writing%20a%20DIY%20Policy%20Icon.%20MIGHTY%20GRC%20for%20Small%20Business.png?width=42&height=42&name=Writing%20a%20DIY%20Policy%20Icon.%20MIGHTY%20GRC%20for%20Small%20Business.png)[How to Create a Disaster Recovery Plan →](https://mightygrc.com/mighty-blog/small-business-disaster-recovery-plan)** Learn how to identify the technology and data your business depends on, establish recovery priorities, understand your backup needs, and plan how you’ll restore critical systems if they become unavailable. They're different plans, but together they give your business multiple paths toward full restoration of normal business operations, and help ensure there is no long-term impact from the security incident. ## How to create an Incident Response Plan for your small business You don't need to begin with cybersecurity jargon or try to document every possible attack your business could experience. **Start with your business, your people, and the decisions they'll need to make.** ### Step 1: Identify the incidents you need to be prepared for ![Identify what may qualify as a security incident for your small business within an Incident Response Plan.](https://mightygrc.com/hs-fs/hubfs/Identify%20Security%20Incidents%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Identify%20Security%20Incidents%20Icon.%20MIGHTY%20GRC.png)You don't need to make predictions. And you definitely don't need a crystal ball. Start simple. Think about the kinds of incidents that could affect the technology, information, accounts, and services your business relies on. That might include: - A compromised employee email account - Phishing or credential theft - Malware or ransomware - A lost or stolen device - Unauthorized access to a business system - Accidental exposure or deletion of sensitive information - Suspicious financial or payment activity - A compromised administrator account - A cybersecurity incident involving an important vendor - An employee or former employee misusing access - An important system behaving unexpectedly Then ask a more useful question: **If this happened tomorrow, would our team know what to do first?** You don't necessarily need a completely different response plan for every scenario. Many of the first decisions will be similar: recognize the problem, report it, bring in the right people, understand what's happening, contain it where appropriate, and determine what happens next. The goal of this exercise is to identify the situations your plan needs to help your team navigate. ### Step 2: Decide what your team should do first if something seems wrong ![Your team should be safe to report a potential cybersecurity incident before it has been confirmed with your Incident Response Plan.](https://mightygrc.com/hs-fs/hubfs/Report%20and%20then%20diagnose%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Report%20and%20then%20diagnose%20Icon.%20MIGHTY%20GRC.png)Your team may be the first people to notice a cybersecurity incident. They may receive a strange email, see an unfamiliar login notification, realize they entered credentials into a suspicious website, lose a company device, or notice that something on their computer isn't behaving normally. Your team doesn't need to diagnose the problem. They need to know what the next right thing to do is to begin to mitigate the incident. ![MIGHTY GRC Quote for Small Business: Your team doesn't need to diagnose the problem. They need to know what the next right thing to do is.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **Your team doesn't need to diagnose the problem. They need to know what the next right thing to do is.** Your plan should give employees simple instructions for reporting suspicious activity, including: - What kinds of activity should be reported - Who they should contact - How they should contact that person - What information they should provide - What they should avoid doing until they receive guidance Make the reporting process easy to remember and easy to use. And make sure employees know that reporting quickly matters more than being certain they're right. ![MIGHTY GRC Quote for Small Business: Reporting quickly matters more than being certain they're right.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **Reporting quickly matters more than being certain they're right.** An employee who clicked a phishing link may be embarrassed or worried about getting in trouble. If that causes them to wait several hours before telling anyone, your business loses valuable response time. Create an environment where employees feel comfortable saying: ***“Something happened, and I'm not sure if it's a problem.”*** Your response team can figure out the rest. ### Step 3: Establish your incident response team ![Establish your incident response team, including team members, experts and third parties.](https://mightygrc.com/hs-fs/hubfs/Establish%20Incident%20Response%20Team%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Establish%20Incident%20Response%20Team%20Icon.%20MIGHTY%20GRC.png)When an incident occurs, someone needs to take the lead. For a small business, an “incident response team” may not be a formal cybersecurity department. It might be the owner, an operations leader, your MSP or cybersecurity provider, and a few other people who become involved depending on what happened. The important thing is deciding who does what and how ahead of an event that requires action.  Your plan should identify who will: - Coordinate the overall response - Assess the technical situation - Contact your MSP or cybersecurity provider - Make important business decisions - Coordinate with your cyber insurance carrier - Engage legal counsel when needed - Communicate with employees - Communicate with customers, vendors, or partners when appropriate - Coordinate recovery - Document what happened and the decisions that were made One person may fill several of these roles. That's completely reasonable for a small business. What matters is that ownership is clear. Also identify backups for critical roles. If the only person who knows what to do is on vacation, unreachable, or has an account affected by the incident, your plan needs another path forward. ![MIGHTY Mindset: Clear Responsibility Creates Confident Response](https://mightygrc.com/hs-fs/hubfs/MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png?width=791&height=397&name=MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png) ### Clear responsibility creates a confident and calm response. **When everyone knows their role, your team can focus on responding instead of figuring out who's responsible.** Shared responsibility starts with clear responsibility. When roles are established ahead of time, people know where they have the authority to act, when to involve someone else, and who is responsible for the next decision. **Documented ownership turns uncertainty into coordinated action.** Shared responsibilities are just one of the ways an Incident Response Plan can help your business respond faster, reduce disruption, and recover with confidence. [Explore the benefits of an Incident Response Plan](https://mightygrc.com/mighty-blog/incident-response-plan-benefits) ### Step 4: Make sure everyone knows how to reach the right people ![Document who to contact and how if an event occurs in your small business Incident Response Plan.](https://mightygrc.com/hs-fs/hubfs/Critical%20Contacts%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Critical%20Contacts%20Icon.%20MIGHTY%20GRC.png)Knowing ***who*** to contact isn't enough. Your team also needs to know ***how*** to reach them. Imagine your company email has been compromised. The response plan containing your MSP's email address isn't particularly useful if email is the very system you don't trust. Document primary *and* alternate contact information for the people and organizations you may need during an incident. That might include: - Incident response lead - Business owner or leadership - MSP or IT provider - Cybersecurity provider - Cyber insurance carrier and claims contact - Legal counsel - Critical technology vendors - Communications or public relations support, if applicable Think about how your own team will communicate as well. If email, Slack, Teams, or another normal communication tool isn't available or shouldn't be used, what's Plan B? It could be phone calls, text messages, or another pre-agreed communication channel. Your plan should make two things very easy to answer: **Who do I need to contact, and how do I reach them?** And keep this information somewhere your team can access even if your normal technology isn't available. ### Step 5: Decide how you'll assess and prioritize an incident ![Document how to assess and then prioritize security incidents in your SMB.](https://mightygrc.com/hs-fs/hubfs/Assess%20and%20Prioritize%20Security%20Incident%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Assess%20and%20Prioritize%20Security%20Incident%20Icon.%20MIGHTY%20GRC.png)Not every cybersecurity incident will require the same response. A suspicious email that no one interacted with is different from a compromised administrator account. A lost laptop may create different concerns depending on what information was stored on it and how the device was protected. Your plan should give your response team a consistent way to understand what's happening. Start with questions like: - What happened? - When did we discover it? - Is it still happening? - Which people, devices, accounts, systems, or information may be affected? - Is customer or employee information potentially involved? - Are critical business operations affected? - Could the incident spread or create additional damage? - Do we know how the incident occurred? - Do we need outside technical expertise immediately? You don't necessarily need an elaborate enterprise severity matrix. A simple classification system such as **Low, Moderate, and High** may be enough if your team clearly understands what those categories mean and what actions each one triggers. ![MIGHTY GRC Quote for Small Business: A simple classification system creates a shared way to determine how urgently your business needs to respond.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **A simple classification system creates a shared way to determine how urgently your business needs to respond.** The important thing is creating a shared way to determine how urgently your business needs to respond and who needs to become involved.   Save and share this infographic with your team!   ![How your small business may want to assess risk for your Incident Response Plan.](https://mightygrc.com/hs-fs/hubfs/How%20to%20assess%20risk%20for%20small%20business%20infographic.%20MIGHTY%20GRC.png?width=700&height=467&name=How%20to%20assess%20risk%20for%20small%20business%20infographic.%20MIGHTY%20GRC.png) ### Step 6: Plan how you'll contain the problem ![Plan for how to contain a cybersecurity incident in your small business.](https://mightygrc.com/hs-fs/hubfs/Security%20Incident%20Containment.%20MightyGRC.png?width=150&height=150&name=Security%20Incident%20Containment.%20MightyGRC.png)Once you understand enough about what's happening, the next priority may be preventing the incident from getting worse. But this is also where incident response can become highly technical. Knowing when to bring in expert support, both during an event and while writing your Incident Response Plan, is an important part of responding effectively. Depending on the situation, containment might involve actions such as: - Disconnecting an affected device - Disabling or locking an account - Revoking active sessions - Resetting credentials - Blocking malicious activity - Isolating an affected system - Restricting access - Contacting a technology provider - Temporarily taking a service offline **Don't assume that taking an obvious action is always the right action.** Turning off a device, deleting files, wiping a system, or making other changes could potentially destroy useful evidence or make it harder for a cybersecurity professional to understand what happened. Your plan doesn't need to teach employees how to perform cybersecurity forensics. It needs to tell them who has authority to make containment decisions and when technical expertise should be brought in. If you work with an MSP or cybersecurity provider, involve them in this part of your planning. Ask what they would want your employees and leadership team to do, and just as importantly, what they *do not* want you to do, before they become involved. ### Step 7: Know who may need to be notified ![Understand who your small business should notify in case of a security incident.](https://mightygrc.com/hs-fs/hubfs/Incident%20Response%20Plan%20Notifications%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Incident%20Response%20Plan%20Notifications%20Icon.%20MIGHTY%20GRC.png)Depending on what happened, people outside your immediate response team may need to become involved. Requirements can depend on where your business operates, where affected individuals live, what information is involved, contractual obligations, industry requirements, insurance coverage, and the circumstances of the incident. That could include: - Your cyber insurance carrier - Legal counsel - Customers - Employees - Vendors or business partners - Regulators or government agencies - Law enforcement But notification requirements aren't something you should try to figure out from a checklist you found online while an incident is unfolding. You don't need to know every notification requirement yourself. You need to know who will help you determine them. Before an incident occurs, identify the legal, insurance, cybersecurity, and other experts you'll contact when you need guidance. If you have cyber insurance, review your policy before something happens. Understand how and when the insurer expects to be notified and whether your coverage requires or provides access to particular incident response, forensic, or legal resources. #### ![Cyber insurance provider may be part of your incident response team for your small business](https://mightygrc.com/hs-fs/hubfs/Disaster%20Recovery%20should%20include%20vendor%20loss%20icon.%20MIGHTY%20GRC.png?width=72&height=72&name=Disaster%20Recovery%20should%20include%20vendor%20loss%20icon.%20MIGHTY%20GRC.png)Your cyber insurer may be part of your response team Cyber insurance can provide more than financial protection after an incident. Depending on your coverage, your insurer may connect you with forensic investigators, legal counsel, data recovery resources, crisis management support, and other experts who can help you respond. That's why your Incident Response Plan should include your insurer's contact information and the circumstances under which they expect you to call. The [FTC recommends](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/cyber-insurance) understanding your coverage ahead of time, including whether your provider offers a 24/7 breach hotline. ### Step 8: Document what is happening in real time and what actions you take ![Document the event as it is occurring.](https://mightygrc.com/hs-fs/hubfs/Document%20actions%20in%20real%20time%20icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Document%20actions%20in%20real%20time%20icon.%20MIGHTY%20GRC.png)Cybersecurity incidents can move quickly. People make phone calls, disable accounts, contact vendors, restore systems, make decisions, and learn new information as the response unfolds. Documenting those actions creates a record of what happened and helps everyone work from the same information. Capture things like: - When the incident was first discovered - Who reported it - What was initially observed - Systems, accounts, devices, or information potentially affected - People and organizations contacted - Actions taken and when - Important decisions and who made them - New information discovered during the response - Recovery actions - Communications or notifications - When the incident was considered contained or resolved This doesn't have to be complicated. A simple incident log with **date/time, action or observation, owner, and notes** can go a long way. Your MSP, cybersecurity provider, insurer, or legal counsel may also have specific guidance about what should be documented and how evidence should be preserved.   ![Incident log for small business Incident Response Plan by MIGHTY GRC and Policy Pilot.](https://mightygrc.com/hs-fs/hubfs/Incident%20Response%20Plan%20Log.%20MIGHTY%20GRC.png?width=600&height=400&name=Incident%20Response%20Plan%20Log.%20MIGHTY%20GRC.png) ### Step 9: Plan how recovery will happen ![Plan how to you will recover from a cyber incident with an Incident Response Plan from MIGHTY GRC and Policy Pilot.](https://mightygrc.com/hs-fs/hubfs/Incident%20and%20Disaster%20Recovery%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Incident%20and%20Disaster%20Recovery%20Icon.%20MIGHTY%20GRC.png)Containing an incident isn't the same as recovering from it. At some point, you'll need to determine when affected systems, accounts, devices, and business processes can safely return to normal. **Don't rush back to normal simply because a system can be turned back on.** Recovering from an incident might involve: - Restoring systems or data - Rebuilding affected devices - Resetting passwords or credentials - Reconfiguring access - Applying security updates - Removing malicious software - Verifying backups - Confirming systems are functioning correctly - Monitoring for signs that the problem has returned This is where your Incident Response Plan and Disaster Recovery Plan begin to work together. Your Incident Response Plan helps determine when and how the business should move toward recovery. Your [Disaster Recovery Plan](https://mightygrc.com/mighty-blog/small-business-disaster-recovery-plan) provides the more detailed process for restoring the technology and data your business depends on. And your [Business Continuity Plan](https://mightygrc.com/mighty-blog/small-business-continuity-plan) may help keep critical work moving while all of that happens. Before returning to normal operations, make sure the people responsible for the response are confident that the immediate threat has been addressed and that affected technology can be used safely. ### Step 10: Decide how you'll communicate ![How will your small business communicate to your team and your customers if a security incident occurs?](https://mightygrc.com/hs-fs/hubfs/Incident%20Response%20Communication%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Incident%20Response%20Communication%20Icon.%20MIGHTY%20GRC.png)Cybersecurity incidents create questions. Your team may want to know whether they should keep working. Customers may notice a service disruption. Vendors may need instructions. Leadership may need regular updates. Without a communication plan, different people may begin filling those information gaps themselves. Decide in advance: - Who communicates with employees? - Who communicates with customers? - Who communicates with vendors or partners? - Who approves external messages? - How frequently will updates be provided? - What communication channels will be used? - What happens if your normal communication system is unavailable? - Who coordinates messaging with legal counsel or your insurer when necessary? Your plan doesn't need prewritten language for every possible incident. It needs a clear process for deciding what should be communicated, by whom, and when. That helps your business communicate more consistently while the people handling the technical response stay focused on their work. ### Step 11: Test your Incident Response Plan ![Make sure you test your Incident Response Plan to spot and adjust to gaps you find.](https://mightygrc.com/hs-fs/hubfs/Test%20Your%20Response%20Plan%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Test%20Your%20Response%20Plan%20Icon.%20MIGHTY%20GRC.png)A plan can look great on paper and still fall apart when people actually try to use it. That's why testing matters. Fortunately, you don't need to create a real cybersecurity incident to test your response. You can run a simple, small business-focused tabletop exercise. Gather the people who would be involved if a cybersecurity incident were to occur, and walk through a realistic scenario together. For example: ![Incident response plan test: Small Business Table Top Exercise](https://mightygrc.com/hs-fs/hubfs/AUP%20Best%20Practice%20address%20new%20technology%20without%20writing%20a%20new%20policy.%20MIGHTY%20GRC.png?width=72&height=72&name=AUP%20Best%20Practice%20address%20new%20technology%20without%20writing%20a%20new%20policy.%20MIGHTY%20GRC.png)It's 9:15 Monday morning. A colleague tells you they entered their Microsoft 365 password into a website after clicking a link in an email. A few minutes later, they received an unexpected multi-factor authentication request. What happens next? Then work through the following questions: 1. Who does the employee contact? 2. Who takes the lead? 3. Do you disable the account? 4. Who contacts your MSP? 5. How do you determine whether someone accessed the account? 6. What other systems could use the same credentials? 7. Could company or customer information have been accessed? 8. Does your cyber insurer need to be contacted? 9. Would anyone outside the business need to be notified? 10. How would the employee regain secure access? As you work through the scenario, you're likely to uncover things you didn't think about when you wrote the plan. ![MIGHTY GRC Quote for Small Business: You're likely to uncover things you didn't think about when you wrote the plan. That's exactly what you want.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **You're likely to uncover things you didn't think about when you wrote the plan. That's exactly what you want.** That's exactly what you want. Update the plan based on what you learn, then test again. **Practice. Learn. Improve. Repeat.** ![MIGHTY Mindset: Practice turns policies into productivity.](https://mightygrc.com/hs-fs/hubfs/MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png?width=791&height=397&name=MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png) ### Practice turns policies into productivity. **A policy is most useful when your team knows how to put it into action.** Testing your Incident Response Plan helps people understand their roles, make decisions faster, and spend less time figuring out what happens next. That same principle applies far beyond incident response. **Good policies create clarity, and clarity helps people get work done.** [Explore how policies protect productivity](https://mightygrc.com/mighty-blog/small-business-policy-productivity) ### Step 12: Learn from every incident and keep improving your plan ![Keep your small business Incident Response Plan current by continuing to improve and adapt it.](https://mightygrc.com/hs-fs/hubfs/Continual%20Improvement%20Icon.%20MIGHTY%20GRC.png?width=150&height=150&name=Continual%20Improvement%20Icon.%20MIGHTY%20GRC.png)Your incident response shouldn't end when the immediate problem is over. Once things have stabilized, it's time to review, review, and update your Incident Response Plan to make it, your team, and your business stronger and more resilient. Bring the people involved back together and ask: - What happened? - What worked well? - Where were we confused? - Did people know who to contact? - Did we have the information and access we needed? - Were there delays we could prevent next time? - Did the incident reveal a security gap? - Did our communication process work? - What should we change? The goal isn't to assign any blame. The goal is to make the next response better. A real incident, tabletop exercise, near miss, or even an employee reporting something suspicious can teach you something about how prepared your business really is. Those lessons may also identify improvements that extend beyond your Incident Response Plan. Maybe you need stronger multi-factor authentication. Maybe employee training needs improvement. Maybe access should be removed faster when someone leaves. Maybe you need a better backup process or [clearer vendor management requirements](https://mightygrc.com/mighty-blog/small-business-vendor-risk-assessment). Those findings can feed directly into your [**Security Improvement Roadmap**](https://mightygrc.com/mighty-blog/small-business-cybersecurity-roadmap), giving you a practical way to prioritize what should improve next. And don't forget the Incident Respond Plan itself. Review it regularly and whenever something significant changes, such as your technology, vendors, employees, insurance coverage, or external support providers. Your Incident Response Plan should evolve alongside your business. ## Can a small business write its own Incident Response Plan? Absolutely. In fact, your team needs to be involved because you understand your business better than anyone else. You know: - Which systems and information matter most - How your employees actually work - Who makes important decisions - Which vendors you depend on - How customers interact with your business - What would create the biggest operational impact - Who needs to be involved when something goes wrong That's an excellent starting point. ![MIGHTY GRC Quote for Small Business: Your team needs to be involved because you understand your business better than anyone else.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **Your team needs to be involved because you understand your business better than anyone else.** But incident response can quickly cross into areas where specialized expertise matters. Cybersecurity professionals can help you understand technical containment, investigation, evidence preservation, account compromise, malware, system security, and recovery. Legal counsel can help determine contractual, regulatory, privacy, and notification obligations. Your cyber insurer can help you understand your coverage and the response resources available through your policy. Your managed service provider, or MSP, may play an important role in identifying, containing, and recovering from incidents involving the technology they manage. [**Policy management software**](https://mightygrc.com/products/policypilot) can help you build your Incident Response Plan more quickly and accurately, turn your decisions into clear, actionable guidance your team can actually follow, and make sure the plan is reviewed and stays current as your business changes. So rather than handing the entire exercise to someone else, **do the business work first.** Be ready to say: Here's what matters to our business. Here's who we've identified to lead. Here's how employees will report something suspicious. Here's who we think needs to be involved. Here's how we plan to communicate and keep critical work moving. Now help us make sure the technical, legal, and insurance pieces of our response will actually work. That's a much more productive conversation. ![MIGHTY Mindset: You know your business. Your experts know their specialties. A strong Incident Response Plan brings those perspectives together.](https://mightygrc.com/hs-fs/hubfs/MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png?width=791&height=397&name=MIGHTY%20Mindset%20Letter%20Icon%20from%20MIGHTY%20GRC.png) ### You know your business. Your experts know their specialties. **An actionable Incident Response Plan brings those perspectives together to ensure your plan can actually be used.** Getting help doesn't mean giving up ownership of your plan. It means strengthening the parts where additional expertise matters. **And your Incident Response Plan doesn't stand alone.** It's one of seven essential policies that can help your business reduce risk, strengthen resilience, and make better decisions as you grow. [Get the MIGHTY Guide to the 7 Essential SMB Policies](https://mightygrc.com/small-business-policy-guide) ## Your small business Incident Response Plan template Once you've worked through the decisions above, it's time to document them. Your Incident Response Plan doesn't need to be a book. It should be: 1. **Short enough to navigate quickly.** 2. **Detailed enough to guide your response.** 3. **Accessible even when your normal technology isn't.** Think of it as a response playbook rather than a report. Here's a simple structure you can use. ### 1. Purpose and scope **Purpose:** What is this plan designed to help your business do? **Scope:** Which employees, systems, locations, information, and technology does it cover? ### 2. What your team should report List examples of activity employees should report, such as suspicious emails, unexpected login notifications, lost devices, malware warnings, accidental information exposure, or anything else that seems unusual. **Report, then assess.**   **Save and print this poster for your conference or break room.**   **![Motivational poster with message: Report then Assess.](https://mightygrc.com/hs-fs/hubfs/Report%20Then%20Assess%20Poster%20for%20Small%20Business.%20MIGHTY%20GRC.png?width=400&height=600&name=Report%20Then%20Assess%20Poster%20for%20Small%20Business.%20MIGHTY%20GRC.png)** ### 3. How to report an incident **Primary contact:** Name / role / phone / email **Backup contact:** Name / role / phone / email **Alternate communication method:** How should employees report an incident if normal communication systems aren't available? ### 4. Incident response roles | Role | Primary Owner | Backup Owner | Responsibilities | | --- | --- | --- | --- | | **Incident Lead** | | | Coordinates response | | **Technical Lead / MSP** | | | Technical investigation and response | | **Business Leadership** | | | Business decisions | | **Communications** | | | Internal/external communication | | **Legal / Insurance** | | | Legal and insurance coordination | | **Recovery Lead** | | | Coordinates return to operations |   For a small business, one person may appear in several rows. ### 5. Initial assessment When an incident is reported, document: What happened? When was it discovered? Is it still happening? What systems, accounts, devices, or information might be affected? Are critical business operations affected? Could customer or employee information be involved? Who needs to be contacted now? ### 6. Immediate response and containment Document the actions your team is authorized to take and identify when your MSP or cybersecurity provider should make the decision. **Important:** Include actions employees should *not* take without guidance. ### 7. Important contacts Maintain current contact information for: 1. MSP / IT provider 2. Cybersecurity provider 3. Cyber insurance carrier 4. Legal counsel 5. Critical technology vendors 6. Business leadership 7. Other response partners ### 8. Communication plan Who communicates with: Employees? Customers? Vendors and partners? Insurer? Other external parties? Who approves external communications? What alternate communication channel will you use if your normal system is unavailable? ### 9. Recovery Document or link to: Recovery priorities Disaster Recovery Plan Backup and restoration procedures Credential reset procedures System validation requirements Who approves return to normal operations ### 10. Incident log template | Date / Time | Action or Observation | Owner | Notes | | --- | --- | --- | --- | | | | | | | | | | | | | | | | ### 11. Post-incident review After the incident, document: What happened? What worked? What didn't? What did we learn? What needs to change? What security improvements should be added to our roadmap? Who owns those improvements? When should they be completed? ## Your Incident Response Plan is really a decision-making tool It's easy to think of an Incident Response Plan as something you write because cybersecurity best practices, customers, insurers, or compliance requirements say you should have one. But its real value is much more practical. **It helps people make better decisions when the business is under pressure.** When (not if) an incident occurs, you don't have to think about: *Who do we call?* *Who is in charge?* *Should we shut this down?* *Do we need to tell someone?* *How do we keep working?* *What do we do next?* You've already worked through many of those questions. There will still be uncertainty. Every incident is different, and some decisions will need to be made as new information becomes available. But your team won't be starting from zero. They will be able to take action. To take the first steps toward recovery, risk mitigation, and normal operations. ![MIGHTY GRC Quote for Small Business: There will still be uncertainty. But your team won't be starting from zero. They will be able to take action.](https://mightygrc.com/hs-fs/hubfs/Quote%20Left%20Icon.%20MIGHTY%20GRC.png?width=42&height=32&name=Quote%20Left%20Icon.%20MIGHTY%20GRC.png)   **There will still be uncertainty. But your team won't be starting from zero. They will be able to take action.** They'll have a shared process, clear responsibilities, trusted experts to call, and a place to begin. ### Not sure where to start? ![Free PDF download to begin writing your Incident Response Plan.](https://mightygrc.com/hs-fs/hubfs/The%20MIGHTY%20Guide%20to%20Seven%20Essential%20Policies%20for%20Small%20Business%20and%20Teams.png?width=955&height=745&name=The%20MIGHTY%20Guide%20to%20Seven%20Essential%20Policies%20for%20Small%20Business%20and%20Teams.png) ## The Mighty Guide to SMB Policies Get your free MIGHTY Guide to writing your first Incident Response Plan, and take the first steps toward building a practical policy program that includes InfoSec, Acceptable Use, AI, Business Continuity, Security Improvement Roadmapping, and more. #### Start with an Incident Response Plan. Build a stronger business. [Download the free MIGHTY Guide PDF now](https://mightygrc.com/small-business-policy-guide)   ## Ready to simplify policy management for your SMB? ![PolicyPilot automates Incident Response Plan creation for SMBs](https://mightygrc.com/hs-fs/hubfs/Risk%20and%20Compliance%20Platform%20Dashboard%20by%20MIGHTY%20GRC.png?width=1536&height=1024&name=Risk%20and%20Compliance%20Platform%20Dashboard%20by%20MIGHTY%20GRC.png) ## Meet PolicyPilot [**PolicyPilot by MIGHTY GRC**](https://mightygrc.com/products/policypilot)helps small businesses turn complex policy requirements into clear, tailored policies built around how their business actually operates. You don't have to start with a blank document or become a cybersecurity expert. Start with your business. Answer a few straightforward questions, and in minutes you can:   Customize your InfoSec Policy for your real world business.   Manage policy reviews and approvals in one place.  Use automated reminders to keep your InfoSec Policy current. Because the goal isn't simply to have an Incident Response Plan. It's to make sure your team knows what to do when it matters. ![PolicyPilot protects small business from avoidable risk.](https://mightygrc.com/hs-fs/hubfs/Business%20Continuity%20Plan%20Icon.%20MIGHTY%20GRC%20for%20Small%20Business.png?width=500&height=235&name=Business%20Continuity%20Plan%20Icon.%20MIGHTY%20GRC%20for%20Small%20Business.png) **Your policies should be simple. They should be actionable.** **And they should actually get used.** **![PolicyPilot: Policy Management Software for Small Businesses](https://mightygrc.com/hs-fs/hubfs/PolicyPilot%20Winged%20Icon%20Logo.%20MIGHTY%20GRC.png?width=448&height=150&name=PolicyPilot%20Winged%20Icon%20Logo.%20MIGHTY%20GRC.png)** **Explore PolicyPilot today and start building your Incident Response Plan in minutes.** [Explore PolicyPilot](https://mightygrc.com/products/policypilot)[Get a Free Product Demo](https://mightygrc.com/policypilot-demo)   #### **Thank you from [the MIGHTY team](https://mightygrc.com/about-mighty-grc). We are dedicated to offering learning resources for small and midsized businesses that are supportive, actionable, and will actually get used.** **Share your thoughts with us [HERE.](https://mightygrc.com/contact)** > **This article is provided for educational and informational purposes only.** It is intended to help small businesses better understand governance, risk, compliance, and policy management, but it is not legal, financial, cybersecurity, insurance, or other professional advice. > > **Use this content as a starting point for building a stronger, more resilient business—not as a substitute for professional advice tailored to your specific needs.** ## Share this post [mailto:https%3A%2F%2Fmightygrc.com%2Fmighty-blog%2Fsmall-business-incident-response-plan](mailto:https%3A%2F%2Fmightygrc.com%2Fmighty-blog%2Fsmall-business-incident-response-plan) ## Keep reading ### [![The benefits of an Acceptable Use Policy for Small Business Resilience](https://mightygrc.com/hs-fs/hubfs/Benefits%20of%20an%20AUP%20for%20Small%20Business.%20MIGHTY%20GRC.png?width=1838&height=1034&name=Benefits%20of%20an%20AUP%20for%20Small%20Business.%20MIGHTY%20GRC.png) Business Resilience Team Autonomy Scaling a Small Business The Benefits of an Acceptable Use Policy for Your Small Business](https://mightygrc.com/mighty-blog/acceptable-use-policy-benefits) ### [![Explore the benefits of vendor risk management for your small business, including secure, scalable growth.](https://mightygrc.com/hs-fs/hubfs/The%20Benefits%20of%20Vendor%20Risk%20Management%20for%20Small%20Business.%20MIGHTY%20GRC.png?width=2368&height=1332&name=The%20Benefits%20of%20Vendor%20Risk%20Management%20for%20Small%20Business.%20MIGHTY%20GRC.png) Business Resilience Scaling a Small Business Risk Mitigation The Benefits of Vendor Risk Management for Your Small Business](https://mightygrc.com/mighty-blog/vendor-risk-management-benefits) ![Screenshot 2026-06-16 at 4.49.38 AM](https://mightygrc.com/hs-fs/hubfs/Screenshot%202026-06-16%20at%204.49.38%20AM.png?width=3244&height=1258&name=Screenshot%202026-06-16%20at%204.49.38%20AM.png) ## MIGHTY GRC MIGHTY is GRC software custom built for small teams to simplify compliance and risk management. Generate policies, assess risk, and stay compliant in one streamlined platform designed for SMBs. - [Home](https://mightygrc.com) - Products - Pricing - Resources - Company - [GET A DEMO](https://mightygrc.com/policypilot-demo) --- Privacy Policy · Legal · © 2026. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Michael Wallace, MIGHTY CoFounder & CEO", "url" : "https://mightygrc.com/mighty-blog/author/michael-wallace" }, "dateModified" : "2026-10-14T18:27:19.396Z", "datePublished" : "2026-10-14T18:27:19.000Z", "headline" : "How to Create an Incident Response Plan Template for a Small Business", "image" : [ "https://mightygrc.com/hubfs/How%20to%20Create%20the%20Template%20for%20an%20Incident%20Respone%20Plan%20for%20Small%20Business.%20MIGHTY%20GRC.png" ], "mainEntityOfPage" : { "@id" : "https://mightygrc.com/mighty-blog/small-business-incident-response-plan", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://mightygrc.com/hubfs/Screenshot%202026-05-20%20at%2010.52.57%20AM.png" } } } ```