Incident response plan for small businesses: how to build one

An incident response plan for a small business is a simple document that defines, before anything happens, who does what when there’s a security problem: how to detect it, contain it, recover, and who to notify. It’s not a hundred-page technical manual; it’s a practical guide that turns panic into clear steps the day an attack or a failure hits you.

Most small businesses don’t have one. According to the company Tantius, only 4 out of 10 small businesses in Mexico have a formal incident response plan—an industry figure, not an official one, but consistent with what’s seen every day. The rest improvise at the worst moment, when the clock is ticking and every minute costs money. The good news: building a basic plan is cheap and within any business’s reach.

What is an incident, and why do I need a plan?

A security incident is any event that compromises your systems or data: ransomware that encrypts your files, a hacked account, a leak of customer information, an employee who deletes something critical by mistake. What they have in common is that time works against you, and decisions under pressure tend to be bad.

A plan exists precisely so you don’t decide under pressure. When everything is written down—who to call, what to disconnect, how to recover—your team acts in minutes instead of wasting hours figuring out what to do. A cheap plan, made ahead of time, prevents expensive losses: less downtime, less lost data, and less damage to your reputation.

What phases should the plan have?

A good response plan follows a logical sequence. You don’t need fancy names; you need each phase to have owners and concrete actions.

• Prepare. Before any incident: define who leads the response, keep key contacts on hand (team, IT provider, bank, legal advisor), inventory your important systems and data, and—this is essential—make sure you have backups that can truly be restored.
• Detect. How you realize something’s happening: alerts, a customer reporting a strange charge, a system that stops responding. Define how a possible incident is reported internally so it doesn’t stay silent.
• Contain. Stop the damage without destroying evidence: disconnect the affected device from the network, change compromised passwords, isolate what you can. The goal is to keep the problem from spreading.
• Eradicate and recover. Remove the cause (the malware, the unauthorized access) and restore operations from clean backups. This is where you find out whether your copies worked.
• Learn and communicate. After the incident: document what happened, what failed, and what to improve, and notify whoever needs to know.

Who should I notify if there’s an incident?

It depends on what was affected, but it’s worth deciding in advance so you don’t hesitate. In general, there are three communication fronts:

• Your internal team. Who takes charge and who executes each action. Everyone should know who to report to without searching in the moment.
• Your customers and suppliers. If their data or the service was affected, timely transparency protects your reputation far more than silence. Explain what happened and what you’re doing.
• The authorities, when applicable. If there was a leak of personal data, the LFPDPPP sets obligations on how to handle and communicate those breaches. In cases with sensitive data, lean on a legal advisor to act in line with the law.

You don’t plan an incident response for if it happens, but for when it happens: the difference between a crisis and a bad moment is a plan that was already ready.

How do I start without overcomplicating it?

Start with a single page. Don’t chase the perfect plan: aim for a plan that exists. Write down—in a document accessible even if your systems are down (printed or on another device)—the key contacts, the basic containment steps, and where your backups are and how to restore them.

Then test it. A plan you never rehearsed is almost as risky as not having one. Run a simple drill once a year—“what would we do if the system woke up hijacked tomorrow?”—and adjust what doesn’t work. With that, you’re already ahead of 6 out of 10 small businesses.

In summary

An incident response plan isn’t a luxury for big companies: it’s a simple roadmap that tells your small business who does what when something goes wrong, with clear phases—prepare, detect, contain, recover, and communicate—and backups that actually work. It’s cheap to build and prevents expensive losses. Start with a single page and test it once a year.

If you want to build your response plan and make sure your backups and systems are ready for the hard day, at Normandia Web we can help you prepare it tailored to your business, so an emergency is just a scare and not a loss.