At a glance: A cyber incident response plan sets out how your business will identify, contain and recover from a cyber security incident. It defines who leads the response, how staff report concerns, how communications are approved and which services need to be restored first. For small businesses, it should connect your IT provider’s technical response with business decisions and continuity arrangements. Keep it accessible if normal systems are unavailable, and test it regularly.
If your staff could not access email, client files or a key business system tomorrow, who would decide what happens next?
Your IT provider would handle the technical work. Your business would still need to prioritise services, communicate with staff and customers, approve urgent changes and keep essential work moving.
A cyber incident response plan makes those responsibilities clear before normal operations are disrupted.
Why a cyber incident response plan matters
The Annual Cyber Threat Report 2025-26 records more than 1,500 incidents handled by the Australian Signals Directorate’s Australian Cyber Security Centre, around 20% more than the previous year. For small businesses, the average cost of cybercrime was $55,400 per report.
The lesson is not that every incident will cost that amount. It is that recovery depends on decisions as well as technology. Security tools may reduce the risk, but your business still needs to know how it will operate if those controls fail.
What should your plan cover?
Keep the plan practical. It should tell people who is responsible, what matters most and how the business will respond.
1. Name the incident lead
Nominate one person to coordinate the response and a backup if they are unavailable. The lead does not need to investigate the technology. They need to keep decisions moving, involve the right advisers and record important actions.
Also confirm who can approve urgent spending, pause affected services and authorise staff or customer communications.
2. Make reporting simple
Staff should know how to report an unexpected sign-in alert, suspicious email, unusual file activity or possible payment fraud. Give them one clear reporting channel and an alternative if email or the helpdesk is unavailable.
Encourage people to report concerns early. They should not need to investigate the problem or prove that an incident has occurred.
3. Prioritise critical services
Identify the work your business must keep delivering, then document the systems, information and suppliers it depends on. For each critical service, record how long you can operate without it, any approved workaround and its recovery priority.
This connects incident response with business continuity. One addresses the incident; the other keeps essential work moving while it is resolved.
4. Plan communications
If email or your normal collaboration tools are affected, decide how the response team will communicate. Keep the necessary contact details somewhere authorised people can still reach.
Confirm who prepares updates, who approves them and when staff, customers or suppliers should hear from you. Avoid promising a restoration time before the technical team has enough evidence.
5. Confirm recovery and external support
Ask your IT provider what is backed up, how recovery works and what has been tested. A backup only helps if the business can restore the information and systems it needs.
Keep current details for your IT provider, cyber insurer and relevant advisers. Assign responsibility for assessing legal, regulatory, contractual and insurance obligations. Businesses that have been, or may have been, affected can contact the Australian Cyber Security Hotline 24 hours a day on 1300 CYBER1 (1300 292 371).
Keep the plan accessible
A cyber incident response plan stored only in your normal document system may be unavailable when you need it. Keep a controlled, current copy in an approved alternative location, with access limited to the people who need it. Consider also storing a printed copy in a secure location, such as a safe, in case IT systems are completely unavailable.
Do the same for essential contact details. The incident lead should not depend on a work mailbox or a colleague’s memory to reach the right people.
Test the plan before an incident
Start with a short discussion involving the business decision-maker, operational leads and IT provider. Work through a realistic scenario, such as suspicious account activity that requires access to shared files to be restricted.
Ask who activates the plan, who can approve disruption, how staff will receive instructions, which customer commitments need attention and who approves the return to normal operations.
Record unanswered questions, assign an owner and set a completion date. A discussion exercise does not replace technical recovery testing, but it will show where business decisions and technical procedures do not connect.
What to check at your next IT review
Use these questions to start the conversation:
- Have we named an incident lead and backup
- Do staff know how to report suspicious activity?
- Have we identified critical services and recovery priorities?
- Can we communicate and access the plan without normal business systems?
- Have we confirmed backup coverage and tested recovery?
- Do we know who handles reporting, insurance and external advice?
- Have we tested the plan and assigned actions?
A template can organise the work, but the answers need to reflect how your business operates.
Do not wait for disruption to expose the gaps
The middle of a cyber incident is not the time to discover that contact details are outdated, recovery priorities are unclear or the plan cannot be accessed.
A practical plan closes those gaps before an incident occurs. Windstil can help your business develop and maintain an incident response plan as part of a broader cyber security approach, alongside ongoing work to improve Essential Eight maturity.
Windstil provides cyber security consulting for Australian businesses. Our active clients enjoy a structured, ongoing approach to Essential Eight, with clear prioritisation, consistent progress and guidance to improve their maturity over time.