Incident Response Plan Template for Small Businesses

Friday, 4:40 p.m., at a plastics manufacturer in Burlington, Ontario. Every screen in accounting shows the same message: your files are encrypted, pay to get them back. The controller calls the IT provider and gets voicemail. The owner is at the airport. One person wants to shut every computer down; another says not to touch anything.

Nobody knows who makes the call. That's exactly the gap an incident response plan fills.

The stakes are real. According to a 2025 CDW study, small Canadian organizations take 25.7 days to recover from an incident, and industry data cited by Insurance Business Canada (October 2025) puts the average cost of a ransomware incident at $330,000. Here is a simple template, based on Canadian Centre for Cyber Security guidance, that you can fill in this week.

What a good incident response plan contains

The Canadian Centre for Cyber Security structures incident response in six phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity with lessons learned. In April 2025, the U.S. NIST revised its reference guide (SP 800-61 Rev. 3) to fold incident response into overall cyber risk management. For a small business, the takeaway is simple: a short document that anyone can follow under stress.

The plan doesn't replace technical expertise. It buys time and prevents the costliest mistakes: wiping evidence, letting the attacker back in, forgetting to call the insurer or missing a legal deadline.

Attach three appendices, prepared ahead of time: your critical systems in the order they must be restored (payroll, production software, email), where your backups live and how to verify them, and a sealed emergency admin credential in case the usual accounts are compromised.

Template section 1: roles

Every role has an owner and a backup. In a 25-person business, one person may wear two hats, but you need to know that in advance.

Template section 2: phases, step by step

Detection and analysis (first hour)

• Note the time, what was seen and by whom. Take photos of the screens.
• Alert the incident coordinator, who decides whether to activate the plan.
• Call your cyber insurer's emergency line before hiring an outside firm: many policies require their own vendors or prior approval. Check yours now.
• Don't reply to the attacker and don't delete anything.

Containment

• Disconnect affected devices from the internet and the internal network, without powering them off if possible, to preserve evidence.
• Cut remote access (VPN, Remote Desktop) until further notice.
• Reset passwords for compromised and admin accounts, from a clean device.
• Confirm that backups are isolated and intact.

Eradication and recovery

• Identify the entry point and fix it before bringing systems back online.
• Restore from verified backups, starting with the critical systems listed in your appendix.
• Monitor restored systems closely for several weeks.

After the incident

• Hold a lessons-learned meeting within two weeks.
• Update the plan, the controls and staff training.

Template section 3: the call tree

On incident day, your email may be compromised and your network unreachable. Print the call tree, store it offline and use cell numbers. Set up a backup communication channel too, such as a group text created in advance.

For ransomware specifically, our anatomy of a ransomware attack explains what usually happens behind the scenes before encryption starts.

Template section 4: privacy obligations

If the incident involves personal information, privacy law adds specific duties. Build them into the plan so you don't discover them mid-crisis.

In Québec (Law 25): every confidentiality incident must be recorded in a register, even minor ones, and kept for at least five years; our incident register template saves time. If the incident presents a risk of serious injury, you must notify the Commission d'accès à l'information (CAI) and the affected individuals "promptly." Law 25 sets no fixed deadline in hours, but delay is not an option. Your privacy officer must be consulted when assessing that risk. Notifying the CAI is far from unusual: it received 518 confidentiality incident notices between January 1 and December 10, 2025. See our guide to reporting a confidentiality incident to the CAI.

Elsewhere in Canada (PIPEDA): breaches of security safeguards that pose a real risk of significant harm must be reported to the Office of the Privacy Commissioner and to affected individuals, and records of every breach must be kept for two years. Some provinces, such as Alberta and British Columbia, have their own private-sector privacy laws.

Rules depend on where you operate and whose data is involved, so validate your specific obligations with your legal advisor.

Testing the plan: the tabletop exercise

A plan that has never been tested won't work. The Cyber Centre recommends testing, reviewing and updating your plan every year. The simplest way is a 90-minute tabletop exercise: around a table, without touching any systems.

Pick a realistic scenario, for example "on a Friday evening, the file server is encrypted and this week's backups can't be found." Then go through the questions one by one: who gets called first? Who decides to stop production? Where is the insurer's number? How long will restoring take? Every hesitant answer goes on your to-do list, and that last question often leads straight to your 3-2-1-1-0 backup strategy.

Our team can help you write the plan, run the exercise and keep it current as part of our ongoing security partner service.