Incident Response Checklist for Small Businesses With Outsourced IT
Updated October 2026 to our current guidance. The original reporting date is unchanged.
For businesses whose IT is handled by an outside provider
Table of contents
Why this plan matters to your customers
You pay someone to handle your IT. Updates run, backups run, and when something breaks, somebody answers the phone. For most days, that is handled.
A plan for the bad day is a different job, and it is the one people outside your business now ask about. Has anyone asked you to prove your security lately: an insurer, a client, an auditor? A bigger customer’s security questionnaire usually includes some version of “Describe your incident response plan,” and the renewal form from your insurer asks much the same thing.
So who has written yours down?
That is what this checklist is for. It assumes an outside provider does the technical work and you make the business decisions. It puts one goal ahead of the rest: getting back to work. A machine shop does not lie awake over a notification letter. It worries about not shipping on Friday. Fill in the blanks, print it, and keep a copy somewhere other than the computers it describes.
Who does what
A response works when two teams know their parts before anything happens.
Your internal team (business leadership)
- Makes the business decisions
- Handles communication with customers, staff, and partners
- Handles legal, HR, and customer relations
- Authorizes emergency actions and spending
Your IT or security provider (technical team)
- Detects and investigates the problem
- Contains it and removes the attacker
- Collects evidence
- Restores systems and data
The rest of this checklist says who does what, and when.
Phase 1: preparation
Do these before you need them.
Step 1: Learn how your IT provider handles an incident
□ Schedule an incident response planning meeting:
- Ask for a copy of their incident procedures
- Ask what they monitor, and when
- Clarify response times (around the clock, or business hours only?)
- Write down how to escalate
□ Confirm your IT provider has:
- An emergency number that is answered at any hour
- Written incident response procedures
- Errors and omissions insurance
- More than one technician who knows your systems
- Forensic investigation skills, or a firm they work with
- Experience with the contracts and rules that apply to your industry
□ Read your service agreement for:
- The guaranteed response time
- What incident response work is included
- What triggers additional fees
- Whether anyone watches your systems outside business hours
- What is not covered
Keeping things running and checking them are two jobs
Most small businesses have someone for IT: a person on staff, a managed provider, or a consultant who comes in when something needs attention. They keep the systems working, and that is real value.
Checking what is installed is a separate job. A program that has not been updated in months, a setting left open, an account that still works for someone who left last year: these are easy to miss when the day is spent keeping everyone running. Nobody did anything wrong. The job simply was not on anyone’s list.
If your business has no regular IT help at all, which is common, nobody may be looking at any of this. Step 4 below includes a way to count it yourself.
Step 2: Build your internal response team
□ Assign roles and backups:
| Role |
Person |
Backup |
Contact at any hour |
| Incident commander (final authority on decisions) |
_______ |
_______ |
_______ |
| IT liaison (link between the business and the IT provider) |
_______ |
_______ |
_______ |
| Communications lead (internal and external messages) |
_______ |
_______ |
_______ |
| Legal counsel |
_______ |
_______ |
_______ |
| HR representative |
_______ |
_______ |
_______ |
| Finance or accounting lead |
_______ |
_______ |
_______ |
| Customer relations lead |
_______ |
_______ |
_______ |
□ Decide who has authority to:
- Shut down systems or the website
- Approve public statements
- Approve or refuse a ransom payment
- Contact law enforcement
- Notify customers and partners
- Make decisions that need the owners or the board
Print it and keep copies in more than one place (the office, a cloud account, a few people’s homes).
□ IT provider emergency contacts:
- Primary emergency line: ___
- Secondary emergency contact: ___
- Account manager: ___
- After-hours escalation: ___
□ Business contacts:
- Cyber insurance carrier: ___
- Cyber insurance policy number: ___
- Legal counsel: ___
- Business insurance agent: ___
- Bank fraud department: ___
- PR consultant (if you have one): ___
□ Law enforcement and regulators:
- FBI Internet Crime Complaint Center (IC3): www.ic3.gov
- State attorney general: ___
- Industry regulator (if any): ___
- Local FBI field office: ___
- Local police non-emergency line: ___
□ Vendors and partners:
- Payment processor: ___
- Cloud service provider: ___
- Website hosting: ___
- Critical suppliers: ___
□ Backup ways to talk:
- If email is down or compromised: ___
- If phones are down: ___
- If the building is closed: ___
Step 4: Know what your business runs on
Work with your IT provider to build and keep this inventory.
□ Critical systems:
- Customer database, where it lives, and how it is backed up
- Financial systems and data
- Email
- Website and online ordering
- Cloud services (list every one)
- Line-of-business applications, including whatever runs scheduling, invoicing, or the shop floor
- Employee information systems
□ Data you hold:
- Data covered by a law or a contract (health, payment card, customer data you agreed to protect)
- Where customer data is stored
- Where employee personal information is stored
- Designs, drawings, and other trade secrets
- Financial records
□ What downtime means for you:
- Which systems do you need to open the doors each day?
- How long can each one be down before you miss a shipment or a deadline?
- How much recent data could you afford to lose (your recovery point)?
- What does an hour of downtime cost in work you cannot do?
- Which customers or contracts require you to tell them about an incident?
□ What is installed on your computers:
Windows Update never touches third-party software. It keeps Windows current and stops there. The PDF reader, the file compression tool, the remote-access program, and the specialty app your office depends on each have their own updater, or none. An inventory that lists the computers but not the programs on them leaves that part out.
Before you count, guess how many programs are on one of your computers and write the number down. Then count them.
Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
Most people guess low. If the second number, the programs that need updating, is higher than you expected, that is common. You don’t have to be able to do this. We’ll do it with you.
Step 5: Know who you have to tell
Your customer contracts often set the shortest clock, so start there. Then check the laws that apply to you.
□ Notice obligations that may apply:
- [ ] Customer and supplier contracts (read the security and notice clauses)
- [ ] State breach notification laws (check each state where the affected people live)
- [ ] HIPAA, if you handle health information (notice to individuals without unreasonable delay and no later than 60 calendar days after discovery: 45 CFR 164.404(b))
- [ ] Defense contracts (report cyber incidents to the Department of Defense within 72 hours of discovery: DFARS 252.204-7012)
- [ ] PCI DSS, if you take payment cards (your card processor’s agreement sets the steps)
- [ ] GDPR, if you hold data on people in Europe (if the breach is likely to put people at risk, notify the supervisory authority within 72 hours of becoming aware of it: European Commission)
- [ ] Other industry rules: ___
Rules change. Have your lawyer confirm these each year.
□ Write down your deadlines:
- Customers: _ (hours or days after discovery)
- Regulators: _
- Law enforcement: _ (if required)
- Credit bureaus: _ (if identity theft is possible)
- Media: _ (only if a rule requires it)
□ Confirm your cyber insurance:
- Policy number: ___
- Coverage limits: ___
- Deductible: ___
- How and how fast you must report an incident: ___
- Vendors the carrier requires or approves (forensics, PR, legal)
- Does it cover business interruption?
- Does it cover ransom payments?
Step 6: Draft your messages in advance
Work with your lawyer on these now, while nobody is in a hurry.
□ Internal:
- First alert to employees
- Status updates
- Back-to-normal announcement
- Lessons-learned summary
□ External:
- Customer notification letter
- Vendor and partner notice
- Media statement (if you would ever need one)
- Regulatory report templates
- Website and social media holding statement
□ For whoever answers the phone:
- What to say when customers call
- How to handle an upset customer
- What can and cannot be shared
- Where to send media questions
Step 7: Practice
□ Leadership (quarterly):
- Review roles
- Walk through a few decisions
- Use the contact sheet for real
- Update phone numbers
□ Employees (monthly, short):
- How to recognize and report a problem
- Who to call when something seems wrong
- Report right away, with no blame for reporting
- What current scam emails look like
□ Tabletop exercise (every six months):
- Walk through an incident with your IT provider
- Practice the handoffs
- Test your backup ways to talk
- Find the gaps
- Update the plan
Scam emails change monthly; most training happens yearly
An employee trained in January may not recognize what is going around in September. A short monthly reminder with one real example (an invoice, a payment change request, a fake shipping notice) does more than an annual session. The rule to repeat: when something asks for money, a password, or a change to bank details, check it through a channel you already trust, such as a phone number you already have.
Step 8: Make sure the backups come back
The question that matters most for getting back to work is whether a backup has ever been restored.
□ Ask your IT provider:
- What backs up our systems?
- How often?
- Where are the copies kept? Is one copy offsite or offline?
- Are the backups encrypted?
- When was a backup last restored, and how long did it take?
- How long would it take to get each critical system running again (recovery time)?
- How much recent work could we lose (recovery point)?
□ Ask for a test:
- A restore test every quarter
- Proof that a critical system comes back, not only a file
- The actual time it took, written down
- A list of anything the backups do not cover
□ Keep offline copies of:
- Critical business documents (paper or an offline drive)
- Customer contact information
- Vendor and supplier lists
- Employee emergency contacts
- Financial records
How to judge the answers
Most owners ask the backup questions and accept the answer, because they have no way to judge it. Two follow-ups help. “When was the last time you restored something for us, and how long did it take?” and “If the server died tonight, what time tomorrow would we be working again?” A provider with a tested backup can answer both with a date and a number.
Phase 2: detection and analysis
Warning signs to report
Train everyone to report these right away.
□ Computers and network:
- Unusual slowdowns or crashes
- Can’t open files or systems
- Files renamed or encrypted
- A ransom message on screen
- Antivirus or security software turned off
- Unexpected pop-ups or error messages
□ Accounts:
- Password reset notices nobody requested
- Locked-out accounts
- Sign-ins from unusual places or at unusual times
- Messages sent from an account that the owner didn’t write
- New users or permissions nobody added
□ Daily operations:
- Customers reporting odd emails from your company
- Website defaced or down
- Point-of-sale or payment problems
- Phone system problems
- Email not being delivered
□ Money:
- Wire or ACH transfers nobody approved
- Vendor invoices that are not real
- A vendor’s bank details changed by email
- Unexpected card charges
- Customer payment disputes you didn’t expect
A familiar website can be the problem
Attackers sometimes break into legitimate sites, such as a supplier’s portal, a trade association page, or an industry news site, by using an outdated plugin or an unpatched content system. They add code that runs in the background while the page looks normal. Advertising networks have carried the same kind of code onto reputable sites. The owners often learn about it last.
The practical point for your team: a site can look right and still be compromised, so “only visit sites you know” is not enough. Keeping browsers and their add-ons current closes many of the holes this code relies on.
How to report
□ When an employee notices something:
- Do not try to fix it.
- Do not click anything else.
- Do not delete anything.
- Report it right away to: ___ (IT liaison)
- Take photos or screenshots.
- Disconnect the device from the network if told to.
□ IT liaison, first 15 minutes:
- Write down who, what, when, and where.
- Call the IT provider’s emergency line.
- Tell the incident commander.
- Start the incident log.
- Hold off on a company-wide announcement until you know more.
The IT provider’s first look
□ Triage (30 to 60 minutes):
- Confirm something happened
- Estimate scope and severity
- List affected systems and data
- Identify what kind of incident it is
- Brief the incident commander
□ Severity levels:
Level 1, critical (full response):
- Ransomware on several systems
- Data actively leaving the network
- Outages that stop operations
- Confirmed exposure of data covered by a law or contract
- A public-facing compromise, such as a defaced website
Level 2, high (closer monitoring):
- Malware on one machine
- A suspected but unconfirmed breach
- One or two compromised accounts
- Attacks stopped by existing controls
- Suspicious activity not yet explained
Level 3, medium (standard response):
- Phishing attempts with no successful sign-in
- Minor configuration problems
- Failed sign-in attempts
- Routine alerts
Level 4, low (watch only):
- Informational events
- Planned updates
- Routine scans
Evidence
□ Technical (your IT provider):
- System logs and network traffic
- Memory captures from affected machines
- Malware samples
- Times of suspicious activity
- How the attacker got in
- Indicators of compromise
□ Business (you):
- Timeline
- Affected accounts
- Systems and data involved
- Estimated scope
- First guess at the cause
Phase 3: response and containment
First hour
Your role
□ Start the response:
- Get the response team on a call
- Brief the incident commander
- Authorize the IT provider to act
- Bring in legal, HR, and communications
- Start writing down every action and decision
□ Make the business calls:
- Approve shutting systems down if the provider recommends it
- Decide whether to pause operations, and which ones
- Decide how and when to tell customers
- Approve emergency spending
- Call your cyber insurance carrier
□ Talk to your own people:
- Brief the owners or executives
- Decide what to tell employees (short and factual at first)
- Move conversations off any email that may be compromised
- Set up a meeting room or a standing call
IT provider’s role
□ Contain it:
- Isolate infected machines
- Disable compromised accounts
- Block malicious addresses and domains
- Separate parts of the network to stop spread
- Save evidence before changing things
- Record every technical step
□ Stop the activity:
- End malicious processes
- Close unauthorized remote access
- Block the attacker’s communication channels
- Stop data from leaving
- Turn off services and ports nobody needs
□ Size the damage:
- Find every compromised system
- Find out whether data was taken or encrypted
- Check that backups are intact and clean
- Work out the entry point and timeline
- Update you regularly
Hours 1 to 24
Your role
□ People outside the business:
- Notify your cyber insurer within the policy’s deadline
- Get your lawyer’s advice
- Start working out who you must notify, and by when
- Prepare holding statements for customers and partners
- Brief the board, if you have one
□ Keep working:
- Start your workarounds
- Decide what can keep running, and how
- Decide which systems come back first
- Tell your biggest customers what to expect on orders and deliveries
□ HR:
- Find out whether an employee was involved
- Prepare employee messages
- Brief managers on what to say
- Arrange special access for the people restoring things
- Decide whether people should work from elsewhere
□ Records:
- Keep the incident log
- Record every decision and who made it
- Track costs for the insurance claim
- Keep all evidence
- Keep the timeline for any required reports
IT provider’s role
□ Investigate:
- Forensic analysis of affected systems
- Full scope of the compromise
- What data was accessed or taken
- What the attacker did
- Any other compromises
- Evidence for law enforcement, if needed
□ Watch closely:
- Add monitoring where needed
- Watch for the attacker coming back
- Watch for your data being posted or sold
- Look for related malware
- Review logs from every system
□ Keep you informed:
- Status updates at least every four hours
- Findings in business terms
- Recommended next steps
- An estimated time to recovery
- Any added costs
Joint decisions
□ Ransomware:
- Can we restore from backups? (the preferred path)
- If not, before any payment decision:
- Talk to your cyber insurer
- Talk to your lawyer
- Ask law enforcement for guidance
- Remember that paying does not guarantee recovery
- Write down why you decided what you decided
□ Law enforcement:
- Decide whether a report is required or simply wise
- Report to the FBI through IC3.gov or the local field office
- Expect that they may not investigate every case
- Decide how you will cooperate
- Balance the investigation against getting back to work
□ Outside forensics:
- Decide whether you need an outside forensic firm
- Usually for large incidents, data covered by law or contract, or possible lawsuits
- Have your IT provider work with the firm
- Hire the firm through your lawyer (this can protect the findings under attorney-client privilege)
- Ask your insurer which firms it covers, and what they cost
Phase 4: recovery
Days 1 to 3: clean up and restore
Your role
□ Approve the recovery plan:
- Review the IT provider’s plan
- Set the order systems come back in
- Approve the timeline and expenses
- Tell customers and staff what to expect
□ Keep the business moving:
- Use workarounds for systems still down
- Keep employees updated
- Tell customers when service will be back
- Keep suppliers informed
- Track the cost
□ Start the required notices:
- Confirm notice requirements with your lawyer
- Prepare customer letters
- Draft any regulatory reports
- Coordinate with PR, if needed
- File the insurance claim
IT provider’s role
□ Remove the attacker:
- Remove malware and attacker tools
- Close the way they got in
- Install the updates for the flaws they used
- Reset compromised passwords
- Rebuild badly infected systems
- Confirm the attacker cannot return
□ Restore:
- Restore from clean, verified backups
- Bring critical systems back first
- Test before people go back to work on them
- Check the data
- Confirm the backups themselves were not touched
- Add the controls that were missing
□ Close gaps:
- Add monitoring where it was thin
- Tighten who can access what
- Turn on two-step sign-in everywhere it is available
- Update firewall rules
- Improve logging and alerts
Days 4 to 14: confirm and watch
Your role
□ Required notices:
- Send customer notices within the legal and contract deadlines
- File regulatory reports
- Notify credit bureaus, if identity theft is possible
- Notify business partners
- Make a public statement, if needed
- Offer credit monitoring, if personal data was exposed
□ Customers:
- Set up a phone line or inbox for questions
- Write a short FAQ
- Brief whoever answers the phone
- Watch what is said on social media
- Answer customer concerns before they ask
□ Money:
- Track every incident cost
- Submit the insurance claim
- Work out the cost of the downtime
- Review your contract obligations
- Assess possible liability with your lawyer
IT provider’s role
□ Confirm:
- Scan for remaining weak spots
- Test from the outside
- Confirm every system is clean
- Confirm monitoring works
- Test that detection works
- Confirm the backups are good
□ Watch closely for 30 to 90 days:
- Extra review of all systems
- Daily checks
- Active searching for signs of the attacker
- Watch for the attacker coming back
Phase 5: after the incident
Weeks 3 to 4: lessons learned
Together
□ Review meeting:
- The incident commander runs it
- Everyone on the response team attends
- IT provider leadership attends
- Walk through the full timeline
- What worked, and what didn’t
- What to change
□ Write it down:
- What caused it?
- How was it noticed?
- What did it cost, in time and money?
- Did the procedures work?
- What took longer than expected?
- What was missing?
- What would we do differently?
□ Update the plan:
- Contact lists
- Procedures
- New scenarios
- Anything that confused people
- New tools or help you need
Your role
□ Look at the bigger picture:
- Where the business stands now
- Whether more investment is needed
- Whether your insurance was enough
- How your IT provider performed
- Brief the owners on the outcome
□ Make changes:
- Update policies
- Improve employee training
- Add the controls you decided on
- Review what you require of your own vendors
- Tighten contract language
□ Keep watching:
- Credit monitoring for affected people (often 12 to 24 months)
- Identity theft claims
- Legal or regulatory follow-up
- Customer retention
IT provider’s role
□ Improve:
- Make the agreed improvements
- Improve monitoring
- Improve backups
- Improve how updates are tracked and installed
- Tighten access
□ Update the roadmap:
- Rank projects based on what happened
- Recommend a budget
- Set a timeline
- Separate quick changes from long projects
Ongoing upkeep
Monthly
□ Security review:
- IT provider briefs you on alerts and events
- Review any minor incidents
- Discuss what has changed
- Update contacts
□ Employees:
- One short reminder with a real example
- Thank people who report things
- A practice phishing test, if you run them
Quarterly
□ Response team meeting:
- Update contact lists
- Confirm roles
- Update message templates
- Note any changes in rules or customer requirements
- Run a tabletop exercise
□ IT provider review:
- Did they meet the agreed response times?
- Review security reports
- Review backup restore test results
- Update the inventory, including the programs on each computer
Annually
□ Full plan review:
- Review the whole plan with your lawyer
- Update for business changes
- Add lessons from any incidents
- Review and renew cyber insurance
- Update notice requirements
□ Full exercise:
- Run a realistic scenario
- Include everyone involved
- Test both the technical and business response
- Find the gaps
- Update the plan
□ Assessment:
- Risk assessment
- Check for unpatched or outdated software
- Review who has access to what
- Audit user accounts and permissions
- Review your vendors’ security
- Update the business continuity plan
Print it and keep copies in more than one place.
Call first
| Contact |
Name |
Phone |
Email |
Notes |
| Incident commander |
___ |
___ |
___ |
Final decision authority |
| IT provider emergency line |
___ |
___ |
___ |
Answered at any hour? |
| IT liaison (internal) |
___ |
___ |
___ |
Main technical contact |
| Backup IT liaison |
___ |
___ |
___ |
|
Response team
| Contact |
Name |
Phone |
Email |
Notes |
| Legal counsel |
___ |
___ |
___ |
|
| Cyber insurance |
___ |
___ |
___ |
Policy #: _ |
| Communications lead |
___ |
___ |
___ |
|
| HR representative |
___ |
___ |
___ |
|
| Finance lead |
___ |
___ |
___ |
|
Outside help
| Contact |
Phone |
Website |
Notes |
| FBI IC3 |
N/A |
www.ic3.gov |
Internet crime reporting |
| FBI local office |
___ |
___ |
For major incidents |
| Business insurance |
___ |
___ |
Policy #: _ |
| Bank fraud department |
___ |
___ |
|
| PR consultant |
___ |
___ |
If needed |
If something is down
| If this fails |
Use this instead |
| Email |
Personal cell phones: ___ |
| Office phones |
Personal mobile: ________ |
| Internet phone system |
Conference line: ________ |
| Building closed |
Meet at: __________ |
Reminders for the day itself
Do
- Report problems right away
- Keep evidence; don’t delete anything
- Follow the chain of command
- Write everything down
- Keep your IT provider informed of business decisions
- Follow your IT provider’s technical advice
- Keep communication calm and factual
- Keep the focus on getting back to work
Don’t
- Try technical fixes without your IT provider
- Pay a ransom without your insurer and lawyer
- Make public statements without legal review
- Blame the employee who reported it
- Skip required notices
- Assume everything is fine without checking
- Rush recovery and skip the cleanup
- Forget to update the plan afterward
Costs to talk through with your insurer
An incident has costs you can plan for. Ask your insurer and your lawyer which of these your policy covers, which vendors it requires, and what each typically costs for a business your size:
- Forensic investigation
- Legal counsel
- Public relations
- Replacement hardware
- Customer notification
- Credit monitoring for affected people
- Lost work while systems are down
- Added monitoring afterward
- Changes to your premium at renewal
Write the answers here, so nobody is looking them up on the day: ___
Annual plan review
Do this every 12 months.
□ Update all contact information
□ Test a backup restore and record the time
□ Confirm your cyber insurance still fits
□ Update notice requirements, starting with customer contracts
□ Update message templates
□ Run a full tabletop exercise
□ Review your IT provider’s service agreement
□ Update the inventory, including installed programs
□ Confirm employee training is current
□ Review lessons from any incidents, yours or ones in the news
□ Update the plan for changes in the business
□ Get the owners’ sign-off
Last reviewed: _______
Next review due: _______
Approved by: _______
Where we fit
You now have the plan for the day something goes wrong. When a bigger customer’s questionnaire asks about it, you can describe it.
The questionnaire usually asks a second thing, too: whether your computers are current. That part you can count tonight. Run the Reveal Scan on your Windows computers and you get two numbers for each one: how many programs are current and how many need updating. If you run it and never speak to us again, that’s a fine outcome.
If customers, insurers, or auditors ask you for that proof regularly, Second Opinion: Reviewed is built for it. We scan your computers every month, a person reviews the results, and you get a prioritized report you can hand over. Whoever runs your IT keeps doing the work; you get a dated record of where the computers stand. Up to 100 computers, from $4,500 a year. See how Second Opinion works.
I have spent 35+ years in cybersecurity. FBI InfraGard trainer. Dozens of managed clients since 1991. None has had ransomware.
Want plain-English security news every week? Sign up for Craig’s Insider Notes at CraigPeterson.com.