Cybersecurity Incident Response

In April 2025 NIST replaced its 2012 incident handling guide with SP 800-61 Rev. 3. The new version is a community profile of the Cybersecurity Framework (CSF) 2.0, and it treats incident response as part of everyday risk management rather than a separate lifecycle. For a small company the lesson is simple. A plan is a set of decisions and owners, not a phase diagram.

Keep the core plan to two or three pages and put the detail in appendices. The Canadian Centre for Cyber Security publishes guidance you can start from. Ours usually holds seven parts:

Print that contact sheet. In ransomware cases the plan often sits on the same file server the attacker has just encrypted. Our vCISO service builds these appendices from your actual systems rather than a template.

Here is how we assign roles at companies of this size, including who we think should not hold each one.

The MSP point is the one vendors dispute. A managed service provider is scoped and paid for uptime. In an incident, uptime and evidence pull in opposite directions. If the attacker came in through a remote management tool, your MSP is also a party to the investigation. Let them run the keyboard, and keep the decisions inside your company.

Attribution and recovery come later. Whoever spots the problem phones the incident lead, not email or chat, because both may be watched. The lead sets a severity level within 15 minutes and asks the scribe to start the timeline. The technical lead isolates affected machines through the endpoint detection and response (EDR) console, disables compromised accounts and revokes active sessions. Nobody powers off or reimages anything yet.

At the same time, the insurer liaison calls the breach hotline and records the claim number. If personal information may be involved, the lead calls breach counsel. Ask counsel whether they should engage the forensic firm, which in some jurisdictions may help protect privilege, though courts have not always agreed. Then move every incident conversation to the out-of-band channel. If money has moved through business email compromise, call your bank's fraud line inside the hour.

The forensic firm, usually from the insurer's panel, collects logs and disk images. The technical lead resets credentials, starting with administrator and service accounts. Before any restore, someone confirms the backups are clean and complete. Restoring an infected backup is a common way to have the same incident twice.

Counsel starts the harm assessment. Which records were exposed? Whose? Where do those people live? Communications drafts a short holding statement: what you know, what you are doing and when you will update customers, with no guesses about causes.

You should now know enough to make the notification decisions below. The GDPR clock, if it applies, is already running. Restore systems in the order your business impact analysis set, not in the order people complain. Report the crime to police and to the Cyber Centre in Canada or the FBI's IC3 in the US. Book the post-incident review within two weeks.

Each law has its own trigger, and the clocks do not start at the same moment.

Summary only; confirm the deadlines that apply to you with Legal Counsel.

Two things catch small companies out. First, the PIPEDA record rule covers every breach of security safeguards involving personal information, including those below the harm threshold, and the OPC can ask to see them. Second, customer contracts can be stricter than any law. Enterprise customers often write 24 to 72 hour notice clauses into their data processing agreements. Add those to the matrix. Our data security and privacy team maps both.

Applications differ by carrier, so treat this as a pattern rather than a checklist. Underwriters commonly ask whether you enforce multi-factor authentication on email, remote access and administrator accounts. They ask whether EDR runs on every endpoint and server, whether backups are offline or immutable, and when you last tested a restore. They ask about patch timelines, phishing training and whether you have a written incident response plan.

Our view is that the plan question carries less weight than the others. An underwriter will rarely read your plan. A claims adjuster may, and will compare what you did against what you declared on the application. If you said MFA was everywhere and the attacker logged in to an account without it, expect a harder claim conversation.

Three policy terms belong in the plan itself: the breach hotline number, whether you must use panel vendors for forensics and counsel, and whether insurer consent is needed before any ransom discussion (sanctions rules may also apply). Read them with your broker before an incident.

A plan nobody has rehearsed is a draft. CISA publishes free tabletop exercise packages you can adapt, but scenarios built from your own systems teach more.

A common pattern we see in these exercises is mundane: the contact list lives only in the system that is down. Pair it with staff awareness training so everyone else knows how to report what they see.

A plan is a set of decisions. It is not a control.

It will not restore backups you never tested. If your restore takes four days, the plan just documents a four-day outage. It will not produce logs you never kept. If audit logging was off or retention was short, the forensic firm cannot scope the breach. Counsel may then advise notifying everyone whose data could have been touched, which is a far larger and costlier exercise.

It will not stop the attack either. Missing MFA, unmanaged laptops and unpatched edge devices are prevention problems, and the DBIR numbers above show where attackers are getting in. It will not rescue a leadership team that overrules its own incident lead in the first hour. And on its own it will not make you SOC 2 or ISO 27001 compliant, although both frameworks expect one. If you do not know where your controls stand, our free Cybersecurity Baseline Assessment gives you a starting score.

Four weeks is enough to go from nothing to a tested first version.

If you would rather not do this alone, IRM writes and tests incident response plans as part of our vCISO engagements. Our pricing starts from US$2,000 a month for 15 to 20 hours. Book a consultation and we will tell you which of the four weeks you can skip.