[{"data":1,"prerenderedAt":664},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"post-\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business":45,"post-alt-\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business":638,"post-rel-\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business":640},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"category":205,"date":577,"description":578,"extension":579,"faq":580,"keyword":590,"meta":591,"minutes":23,"navigation":226,"path":592,"rawbody":593,"seo":594,"sources":595,"stem":629,"tags":630,"translationKey":635,"updated":636,"__hash__":637},"blog_en\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business.md","Incident Response Plan Template for Small Businesses",{"type":49,"value":50,"toc":563},"minimark",[51,55,58,61,82,87,90,93,96,100,103,202,206,210,215,256,260,291,295,319,323,340,344,347,497,506,510,513,529,535,538,542,545,553,560],[52,53,54],"p",{},"Friday, 4:40 p.m., at a plastics manufacturer in Burlington, Ontario. Every screen in accounting shows the same message: your files are encrypted, pay to get them back. The controller calls the IT provider and gets voicemail. The owner is at the airport. One person wants to shut every computer down; another says not to touch anything.",[52,56,57],{},"Nobody knows who makes the call. That's exactly the gap an incident response plan fills.",[52,59,60],{},"The stakes are real. According to a 2025 CDW study, small Canadian organizations take 25.7 days to recover from an incident, and industry data cited by Insurance Business Canada (October 2025) puts the average cost of a ransomware incident at $330,000. Here is a simple template, based on Canadian Centre for Cyber Security guidance, that you can fill in this week.",[62,63,66],"callout",{"title":64,"type":65},"TL;DR","tip",[67,68,69,73,76,79],"ul",{},[70,71,72],"li",{},"An incident response plan says who decides, who calls whom and what to do in the first hour.",[70,74,75],{},"The template has four sections: roles, phases, call tree and legal obligations.",[70,77,78],{},"Keep a printed or offline copy: on the day of the incident, your network may be unavailable.",[70,80,81],{},"Test it at least once a year with a 90-minute tabletop exercise.",[83,84,86],"h2",{"id":85},"what-a-good-incident-response-plan-contains","What a good incident response plan contains",[52,88,89],{},"The Canadian Centre for Cyber Security structures incident response in six phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity with lessons learned. In April 2025, the U.S. NIST revised its reference guide (SP 800-61 Rev. 3) to fold incident response into overall cyber risk management. For a small business, the takeaway is simple: a short document that anyone can follow under stress.",[52,91,92],{},"The plan doesn't replace technical expertise. It buys time and prevents the costliest mistakes: wiping evidence, letting the attacker back in, forgetting to call the insurer or missing a legal deadline.",[52,94,95],{},"Attach three appendices, prepared ahead of time: your critical systems in the order they must be restored (payroll, production software, email), where your backups live and how to verify them, and a sealed emergency admin credential in case the usual accounts are compromised.",[83,97,99],{"id":98},"template-section-1-roles","Template section 1: roles",[52,101,102],{},"Every role has an owner and a backup. In a 25-person business, one person may wear two hats, but you need to know that in advance.",[104,105,106,125],"table",{},[107,108,109],"thead",{},[110,111,112,116,119,122],"tr",{},[113,114,115],"th",{},"Role",[113,117,118],{},"Responsibilities",[113,120,121],{},"Owner",[113,123,124],{},"Backup",[126,127,128,142,154,166,178,190],"tbody",{},[110,129,130,134,137,140],{},[131,132,133],"td",{},"Incident coordinator",[131,135,136],{},"Activates the plan, keeps the action log, brings people in",[131,138,139],{},"_________",[131,141,139],{},[110,143,144,147,150,152],{},[131,145,146],{},"Leadership",[131,148,149],{},"Business decisions: shutting down operations, spending, communications",[131,151,139],{},[131,153,139],{},[110,155,156,159,162,164],{},[131,157,158],{},"IT lead or provider",[131,160,161],{},"Technical analysis, isolation, restoration",[131,163,139],{},[131,165,139],{},[110,167,168,171,174,176],{},[131,169,170],{},"Privacy officer",[131,172,173],{},"Assesses risk of harm, keeps the breach record, handles notifications",[131,175,139],{},[131,177,139],{},[110,179,180,183,186,188],{},[131,181,182],{},"Communications",[131,184,185],{},"Messages to staff, customers, suppliers and media",[131,187,139],{},[131,189,139],{},[110,191,192,195,198,200],{},[131,193,194],{},"Legal advisor",[131,196,197],{},"Legal obligations, contracts, dealings with authorities",[131,199,139],{},[131,201,139],{},[203,204],"cta",{"variant":205},"audit",[83,207,209],{"id":208},"template-section-2-phases-step-by-step","Template section 2: phases, step by step",[211,212,214],"h3",{"id":213},"detection-and-analysis-first-hour","Detection and analysis (first hour)",[67,216,219,230,237,249],{"className":217},[218],"contains-task-list",[70,220,223,229],{"className":221},[222],"task-list-item",[224,225],"input",{"disabled":226,"type":227,"aria-label":228},true,"checkbox","Note the time, what was seen and by whom. Take photos of the screens."," Note the time, what was seen and by whom. Take photos of the screens.",[70,231,233,236],{"className":232},[222],[224,234],{"disabled":226,"type":227,"aria-label":235},"Alert the incident coordinator, who decides whether to activate the plan."," Alert the incident coordinator, who decides whether to activate the plan.",[70,238,240,243,244,248],{"className":239},[222],[224,241],{"disabled":226,"type":227,"aria-label":242},"Call your cyber insurer's emergency line before hiring an outside firm: many policies require their own vendors or prior approval. Check yours now."," Call your cyber insurer's emergency line ",[245,246,247],"strong",{},"before"," hiring an outside firm: many policies require their own vendors or prior approval. Check yours now.",[70,250,252,255],{"className":251},[222],[224,253],{"disabled":226,"type":227,"aria-label":254},"Don't reply to the attacker and don't delete anything."," Don't reply to the attacker and don't delete anything.",[211,257,259],{"id":258},"containment","Containment",[67,261,263,270,277,284],{"className":262},[218],[70,264,266,269],{"className":265},[222],[224,267],{"disabled":226,"type":227,"aria-label":268},"Disconnect affected devices from the internet and the internal network, without powering them off if possible, to preserve evidence."," Disconnect affected devices from the internet and the internal network, without powering them off if possible, to preserve evidence.",[70,271,273,276],{"className":272},[222],[224,274],{"disabled":226,"type":227,"aria-label":275},"Cut remote access (VPN, Remote Desktop) until further notice."," Cut remote access (VPN, Remote Desktop) until further notice.",[70,278,280,283],{"className":279},[222],[224,281],{"disabled":226,"type":227,"aria-label":282},"Reset passwords for compromised and admin accounts, from a clean device."," Reset passwords for compromised and admin accounts, from a clean device.",[70,285,287,290],{"className":286},[222],[224,288],{"disabled":226,"type":227,"aria-label":289},"Confirm that backups are isolated and intact."," Confirm that backups are isolated and intact.",[211,292,294],{"id":293},"eradication-and-recovery","Eradication and recovery",[67,296,298,305,312],{"className":297},[218],[70,299,301,304],{"className":300},[222],[224,302],{"disabled":226,"type":227,"aria-label":303},"Identify the entry point and fix it before bringing systems back online."," Identify the entry point and fix it before bringing systems back online.",[70,306,308,311],{"className":307},[222],[224,309],{"disabled":226,"type":227,"aria-label":310},"Restore from verified backups, starting with the critical systems listed in your appendix."," Restore from verified backups, starting with the critical systems listed in your appendix.",[70,313,315,318],{"className":314},[222],[224,316],{"disabled":226,"type":227,"aria-label":317},"Monitor restored systems closely for several weeks."," Monitor restored systems closely for several weeks.",[211,320,322],{"id":321},"after-the-incident","After the incident",[67,324,326,333],{"className":325},[218],[70,327,329,332],{"className":328},[222],[224,330],{"disabled":226,"type":227,"aria-label":331},"Hold a lessons-learned meeting within two weeks."," Hold a lessons-learned meeting within two weeks.",[70,334,336,339],{"className":335},[222],[224,337],{"disabled":226,"type":227,"aria-label":338},"Update the plan, the controls and staff training."," Update the plan, the controls and staff training.",[83,341,343],{"id":342},"template-section-3-the-call-tree","Template section 3: the call tree",[52,345,346],{},"On incident day, your email may be compromised and your network unreachable. Print the call tree, store it offline and use cell numbers. Set up a backup communication channel too, such as a group text created in advance.",[104,348,349,365],{},[107,350,351],{},[110,352,353,356,359,362],{},[113,354,355],{},"Order",[113,357,358],{},"Who",[113,360,361],{},"When",[113,363,364],{},"Contact details",[126,366,367,380,392,406,417,430,442,455,469,483],{},[110,368,369,372,374,377],{},[131,370,371],{},"1",[131,373,133],{},[131,375,376],{},"Immediately",[131,378,379],{},"Cell: _________",[110,381,382,385,388,390],{},[131,383,384],{},"2",[131,386,387],{},"IT provider (emergency line)",[131,389,376],{},[131,391,139],{},[110,393,394,397,400,403],{},[131,395,396],{},"3",[131,398,399],{},"Cyber insurer (emergency line)",[131,401,402],{},"Within the first hour",[131,404,405],{},"Policy no.: _________",[110,407,408,411,413,415],{},[131,409,410],{},"4",[131,412,146],{},[131,414,402],{},[131,416,139],{},[110,418,419,422,425,428],{},[131,420,421],{},"5",[131,423,424],{},"Incident response firm",[131,426,427],{},"As directed by insurer",[131,429,139],{},[110,431,432,435,437,440],{},[131,433,434],{},"6",[131,436,194],{},[131,438,439],{},"As soon as data theft is possible",[131,441,139],{},[110,443,444,447,450,453],{},[131,445,446],{},"7",[131,448,449],{},"Bank",[131,451,452],{},"Immediately if a fraudulent transfer occurred",[131,454,139],{},[110,456,457,460,463,466],{},[131,458,459],{},"8",[131,461,462],{},"Local police",[131,464,465],{},"If a crime is suspected",[131,467,468],{},"911 for emergencies, otherwise local detachment",[110,470,471,474,477,480],{},[131,472,473],{},"9",[131,475,476],{},"Canadian Anti-Fraud Centre \u002F RCMP reporting system",[131,478,479],{},"In case of fraud or cybercrime",[131,481,482],{},"1-888-495-8501",[110,484,485,488,491,494],{},[131,486,487],{},"10",[131,489,490],{},"Canadian Centre for Cyber Security",[131,492,493],{},"Voluntary report",[131,495,496],{},"cyber.gc.ca\u002Fen\u002Fincident-management",[52,498,499,500,505],{},"For ransomware specifically, our ",[501,502,504],"a",{"href":503},"\u002Fen\u002Fblog\u002Fransomware-small-business-attack-anatomy","anatomy of a ransomware attack"," explains what usually happens behind the scenes before encryption starts.",[83,507,509],{"id":508},"template-section-4-privacy-obligations","Template section 4: privacy obligations",[52,511,512],{},"If the incident involves personal information, privacy law adds specific duties. Build them into the plan so you don't discover them mid-crisis.",[52,514,515,518,519,523,524,528],{},[245,516,517],{},"In Québec (Law 25):"," every confidentiality incident must be recorded in a register, even minor ones, and kept for at least five years; our ",[501,520,522],{"href":521},"\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template","incident register template"," saves time. If the incident presents a risk of serious injury, you must notify the Commission d'accès à l'information (CAI) and the affected individuals \"promptly.\" Law 25 sets no fixed deadline in hours, but delay is not an option. Your privacy officer must be consulted when assessing that risk. Notifying the CAI is far from unusual: it received 518 confidentiality incident notices between January 1 and December 10, 2025. See our guide to ",[501,525,527],{"href":526},"\u002Fen\u002Fblog\u002Freport-confidentiality-incident-cai-law-25","reporting a confidentiality incident to the CAI",".",[52,530,531,534],{},[245,532,533],{},"Elsewhere in Canada (PIPEDA):"," breaches of security safeguards that pose a real risk of significant harm must be reported to the Office of the Privacy Commissioner and to affected individuals, and records of every breach must be kept for two years. Some provinces, such as Alberta and British Columbia, have their own private-sector privacy laws.",[52,536,537],{},"Rules depend on where you operate and whose data is involved, so validate your specific obligations with your legal advisor.",[83,539,541],{"id":540},"testing-the-plan-the-tabletop-exercise","Testing the plan: the tabletop exercise",[52,543,544],{},"A plan that has never been tested won't work. The Cyber Centre recommends testing, reviewing and updating your plan every year. The simplest way is a 90-minute tabletop exercise: around a table, without touching any systems.",[52,546,547,548,552],{},"Pick a realistic scenario, for example \"on a Friday evening, the file server is encrypted and this week's backups can't be found.\" Then go through the questions one by one: who gets called first? Who decides to stop production? Where is the insurer's number? How long will restoring take? Every hesitant answer goes on your to-do list, and that last question often leads straight to your ",[501,549,551],{"href":550},"\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware","3-2-1-1-0 backup"," strategy.",[52,554,555,556,559],{},"Our team can help you write the plan, run the exercise and keep it current as part of our ",[501,557,558],{"href":25},"ongoing security partner"," service.",[203,561],{"variant":562},"devis",{"title":564,"searchDepth":11,"depth":15,"links":565},"",[566,567,568,574,575,576],{"id":85,"depth":11,"text":86},{"id":98,"depth":11,"text":99},{"id":208,"depth":11,"text":209,"children":569},[570,571,572,573],{"id":213,"depth":15,"text":214},{"id":258,"depth":15,"text":259},{"id":293,"depth":15,"text":294},{"id":321,"depth":15,"text":322},{"id":342,"depth":11,"text":343},{"id":508,"depth":11,"text":509},{"id":540,"depth":11,"text":541},"2026-10-24","An incident response plan template for small businesses: roles, response phases, a call tree and privacy obligations under Law 25 and PIPEDA, ready to use.","md",[581,584,587],{"q":582,"a":583},"Does a 10-person business really need an incident response plan?","Yes, and that's where it helps most, because there is no security team to improvise. For a small business, the plan can fit in a few pages: who to call, who decides, what to disconnect and which obligations apply. A few hours of preparation prevent rushed decisions on the day everything stops.",{"q":585,"a":586},"Should we pay the ransom in a ransomware attack?","The Canadian Centre for Cyber Security says the decision rests with the organization, but that paying does not guarantee you'll get your data back and it funds further attacks. Criminals may demand more or leak the data anyway, and paying may be unlawful in some circumstances. Never decide alone: involve your insurer, your legal advisor and a specialized response firm.",{"q":588,"a":589},"Doesn't our IT provider already have a plan that covers us?","They may have a procedure for their own technical work, but it won't cover your business decisions, your communications with customers or your privacy obligations. Check your contract: response times, hours covered including evenings and weekends, and what's billed as extra. Your company plan should connect to theirs, not be replaced by it.","incident response plan template",{},"\u002Fen\u002Fblog\u002Fincident-response-plan-template-small-business","---\ntitle: \"Incident Response Plan Template for Small Businesses\"\ndescription: \"An incident response plan template for small businesses: roles, response phases, a call tree and privacy obligations under Law 25 and PIPEDA, ready to use.\"\ndate: 2026-10-24\ncategory: audit\ntags: [\"incident-response\", \"ransomware\", \"privacy\", \"small-business\"]\ntranslationKey: plan-reponse-incidents\nkeyword: \"incident response plan template\"\nfaq:\n  - q: \"Does a 10-person business really need an incident response plan?\"\n    a: \"Yes, and that's where it helps most, because there is no security team to improvise. For a small business, the plan can fit in a few pages: who to call, who decides, what to disconnect and which obligations apply. A few hours of preparation prevent rushed decisions on the day everything stops.\"\n  - q: \"Should we pay the ransom in a ransomware attack?\"\n    a: \"The Canadian Centre for Cyber Security says the decision rests with the organization, but that paying does not guarantee you'll get your data back and it funds further attacks. Criminals may demand more or leak the data anyway, and paying may be unlawful in some circumstances. Never decide alone: involve your insurer, your legal advisor and a specialized response firm.\"\n  - q: \"Doesn't our IT provider already have a plan that covers us?\"\n    a: \"They may have a procedure for their own technical work, but it won't cover your business decisions, your communications with customers or your privacy obligations. Check your contract: response times, hours covered including evenings and weekends, and what's billed as extra. Your company plan should connect to theirs, not be replaced by it.\"\nsources:\n  - title: \"Canadian Centre for Cyber Security: Developing your incident response plan (ITSAP.40.003)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fdeveloping-your-incident-response-plan-itsap40003\"\n  - title: \"Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fransomware-playbook-itsm00099\"\n  - title: \"Canadian Centre for Cyber Security: Have you been a victim of cybercrime?\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fhave-you-been-victim-cybercrime\"\n  - title: \"RCMP: Report cybercrime and fraud\"\n    url: \"https:\u002F\u002Frcmp.ca\u002Fen\u002Ffederal-policing\u002Fcybercrime\u002Fnational-cybercrime-coordination-centre\u002Freport-cybercrime-and-fraud\"\n  - title: \"NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations (2025)\"\n    url: \"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F61\u002Fr3\u002Ffinal\"\n  - title: \"Office of the Privacy Commissioner of Canada: Mandatory reporting of breaches of security safeguards\"\n    url: \"https:\u002F\u002Fwww.priv.gc.ca\u002Fen\u002Fprivacy-topics\u002Fbusiness-privacy\u002Fbreaches-and-safeguards\u002Fprivacy-breaches-at-your-business\u002Fgd_pb_201810\u002F\"\n  - title: \"Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)\"\n    url: \"https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1\"\n  - title: \"Blakes: New breach reporting requirements in force in Quebec\"\n    url: \"https:\u002F\u002Fwww.blakes.com\u002Finsights\u002Fnew-breach-reporting-requirements-in-qc\u002F\"\n  - title: \"CAI decision citing the number of incident notices received in 2025\"\n    url: \"https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fuploads\u002Fpdfs\u002FAI-2526-238_Decision.pdf\"\n  - title: \"CDW Canada: IT and cybersecurity trends for small businesses in Canada (2025)\"\n    url: \"https:\u002F\u002Fwww.cdw.ca\u002Fcontent\u002Fcdwca\u002Fen\u002Farticles\u002Fsecurity\u002Fit-and-cybersecurity-trends-for-small-businesses-in-canada.html\"\n  - title: \"Insurance Business Canada: AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)\"\n    url: \"https:\u002F\u002Fwww.insurancebusinessmag.com\u002Fca\u002Fnews\u002Fcyber\u002Faipowered-attacks-push-cyber-risks-higher-for-canadas-smes-zensurance-551828.aspx\"\n---\n\nFriday, 4:40 p.m., at a plastics manufacturer in Burlington, Ontario. Every screen in accounting shows the same message: your files are encrypted, pay to get them back. The controller calls the IT provider and gets voicemail. The owner is at the airport. One person wants to shut every computer down; another says not to touch anything.\n\nNobody knows who makes the call. That's exactly the gap an incident response plan fills.\n\nThe stakes are real. According to a 2025 CDW study, small Canadian organizations take 25.7 days to recover from an incident, and industry data cited by Insurance Business Canada (October 2025) puts the average cost of a ransomware incident at $330,000. Here is a simple template, based on Canadian Centre for Cyber Security guidance, that you can fill in this week.\n\n::callout{type=\"tip\" title=\"TL;DR\"}\n- An incident response plan says who decides, who calls whom and what to do in the first hour.\n- The template has four sections: roles, phases, call tree and legal obligations.\n- Keep a printed or offline copy: on the day of the incident, your network may be unavailable.\n- Test it at least once a year with a 90-minute tabletop exercise.\n::\n\n## What a good incident response plan contains\n\nThe Canadian Centre for Cyber Security structures incident response in six phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity with lessons learned. In April 2025, the U.S. NIST revised its reference guide (SP 800-61 Rev. 3) to fold incident response into overall cyber risk management. For a small business, the takeaway is simple: a short document that anyone can follow under stress.\n\nThe plan doesn't replace technical expertise. It buys time and prevents the costliest mistakes: wiping evidence, letting the attacker back in, forgetting to call the insurer or missing a legal deadline.\n\nAttach three appendices, prepared ahead of time: your critical systems in the order they must be restored (payroll, production software, email), where your backups live and how to verify them, and a sealed emergency admin credential in case the usual accounts are compromised.\n\n## Template section 1: roles\n\nEvery role has an owner and a backup. In a 25-person business, one person may wear two hats, but you need to know that in advance.\n\n| Role | Responsibilities | Owner | Backup |\n|---|---|---|---|\n| Incident coordinator | Activates the plan, keeps the action log, brings people in | _________ | _________ |\n| Leadership | Business decisions: shutting down operations, spending, communications | _________ | _________ |\n| IT lead or provider | Technical analysis, isolation, restoration | _________ | _________ |\n| Privacy officer | Assesses risk of harm, keeps the breach record, handles notifications | _________ | _________ |\n| Communications | Messages to staff, customers, suppliers and media | _________ | _________ |\n| Legal advisor | Legal obligations, contracts, dealings with authorities | _________ | _________ |\n\n::cta{variant=\"audit\"}\n::\n\n## Template section 2: phases, step by step\n\n### Detection and analysis (first hour)\n\n- [ ] Note the time, what was seen and by whom. Take photos of the screens.\n- [ ] Alert the incident coordinator, who decides whether to activate the plan.\n- [ ] Call your cyber insurer's emergency line **before** hiring an outside firm: many policies require their own vendors or prior approval. Check yours now.\n- [ ] Don't reply to the attacker and don't delete anything.\n\n### Containment\n\n- [ ] Disconnect affected devices from the internet and the internal network, without powering them off if possible, to preserve evidence.\n- [ ] Cut remote access (VPN, Remote Desktop) until further notice.\n- [ ] Reset passwords for compromised and admin accounts, from a clean device.\n- [ ] Confirm that backups are isolated and intact.\n\n### Eradication and recovery\n\n- [ ] Identify the entry point and fix it before bringing systems back online.\n- [ ] Restore from verified backups, starting with the critical systems listed in your appendix.\n- [ ] Monitor restored systems closely for several weeks.\n\n### After the incident\n\n- [ ] Hold a lessons-learned meeting within two weeks.\n- [ ] Update the plan, the controls and staff training.\n\n## Template section 3: the call tree\n\nOn incident day, your email may be compromised and your network unreachable. Print the call tree, store it offline and use cell numbers. Set up a backup communication channel too, such as a group text created in advance.\n\n| Order | Who | When | Contact details |\n|---|---|---|---|\n| 1 | Incident coordinator | Immediately | Cell: _________ |\n| 2 | IT provider (emergency line) | Immediately | _________ |\n| 3 | Cyber insurer (emergency line) | Within the first hour | Policy no.: _________ |\n| 4 | Leadership | Within the first hour | _________ |\n| 5 | Incident response firm | As directed by insurer | _________ |\n| 6 | Legal advisor | As soon as data theft is possible | _________ |\n| 7 | Bank | Immediately if a fraudulent transfer occurred | _________ |\n| 8 | Local police | If a crime is suspected | 911 for emergencies, otherwise local detachment |\n| 9 | Canadian Anti-Fraud Centre \u002F RCMP reporting system | In case of fraud or cybercrime | 1-888-495-8501 |\n| 10 | Canadian Centre for Cyber Security | Voluntary report | cyber.gc.ca\u002Fen\u002Fincident-management |\n\nFor ransomware specifically, our [anatomy of a ransomware attack](\u002Fen\u002Fblog\u002Fransomware-small-business-attack-anatomy) explains what usually happens behind the scenes before encryption starts.\n\n## Template section 4: privacy obligations\n\nIf the incident involves personal information, privacy law adds specific duties. Build them into the plan so you don't discover them mid-crisis.\n\n**In Québec (Law 25):** every confidentiality incident must be recorded in a register, even minor ones, and kept for at least five years; our [incident register template](\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template) saves time. If the incident presents a risk of serious injury, you must notify the Commission d'accès à l'information (CAI) and the affected individuals \"promptly.\" Law 25 sets no fixed deadline in hours, but delay is not an option. Your privacy officer must be consulted when assessing that risk. Notifying the CAI is far from unusual: it received 518 confidentiality incident notices between January 1 and December 10, 2025. See our guide to [reporting a confidentiality incident to the CAI](\u002Fen\u002Fblog\u002Freport-confidentiality-incident-cai-law-25).\n\n**Elsewhere in Canada (PIPEDA):** breaches of security safeguards that pose a real risk of significant harm must be reported to the Office of the Privacy Commissioner and to affected individuals, and records of every breach must be kept for two years. Some provinces, such as Alberta and British Columbia, have their own private-sector privacy laws.\n\nRules depend on where you operate and whose data is involved, so validate your specific obligations with your legal advisor.\n\n## Testing the plan: the tabletop exercise\n\nA plan that has never been tested won't work. The Cyber Centre recommends testing, reviewing and updating your plan every year. The simplest way is a 90-minute tabletop exercise: around a table, without touching any systems.\n\nPick a realistic scenario, for example \"on a Friday evening, the file server is encrypted and this week's backups can't be found.\" Then go through the questions one by one: who gets called first? Who decides to stop production? Where is the insurer's number? How long will restoring take? Every hesitant answer goes on your to-do list, and that last question often leads straight to your [3-2-1-1-0 backup](\u002Fen\u002Fblog\u002F3-2-1-1-0-backup-rule-ransomware) strategy.\n\nOur team can help you write the plan, run the exercise and keep it current as part of our [ongoing security partner](\u002Fen\u002Fservices\u002Fongoing-security-partner) service.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":578},[596,599,602,605,608,611,614,617,620,623,626],{"title":597,"url":598},"Canadian Centre for Cyber Security: Developing your incident response plan (ITSAP.40.003)","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fdeveloping-your-incident-response-plan-itsap40003",{"title":600,"url":601},"Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fransomware-playbook-itsm00099",{"title":603,"url":604},"Canadian Centre for Cyber Security: Have you been a victim of cybercrime?","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fhave-you-been-victim-cybercrime",{"title":606,"url":607},"RCMP: Report cybercrime and fraud","https:\u002F\u002Frcmp.ca\u002Fen\u002Ffederal-policing\u002Fcybercrime\u002Fnational-cybercrime-coordination-centre\u002Freport-cybercrime-and-fraud",{"title":609,"url":610},"NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations (2025)","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F61\u002Fr3\u002Ffinal",{"title":612,"url":613},"Office of the Privacy Commissioner of Canada: Mandatory reporting of breaches of security safeguards","https:\u002F\u002Fwww.priv.gc.ca\u002Fen\u002Fprivacy-topics\u002Fbusiness-privacy\u002Fbreaches-and-safeguards\u002Fprivacy-breaches-at-your-business\u002Fgd_pb_201810\u002F",{"title":615,"url":616},"Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)","https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1",{"title":618,"url":619},"Blakes: New breach reporting requirements in force in Quebec","https:\u002F\u002Fwww.blakes.com\u002Finsights\u002Fnew-breach-reporting-requirements-in-qc\u002F",{"title":621,"url":622},"CAI decision citing the number of incident notices received in 2025","https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fuploads\u002Fpdfs\u002FAI-2526-238_Decision.pdf",{"title":624,"url":625},"CDW Canada: IT and cybersecurity trends for small businesses in Canada (2025)","https:\u002F\u002Fwww.cdw.ca\u002Fcontent\u002Fcdwca\u002Fen\u002Farticles\u002Fsecurity\u002Fit-and-cybersecurity-trends-for-small-businesses-in-canada.html",{"title":627,"url":628},"Insurance Business Canada: AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)","https:\u002F\u002Fwww.insurancebusinessmag.com\u002Fca\u002Fnews\u002Fcyber\u002Faipowered-attacks-push-cyber-risks-higher-for-canadas-smes-zensurance-551828.aspx","en\u002Fblog\u002Fincident-response-plan-template-small-business",[631,632,633,634],"incident-response","ransomware","privacy","small-business","plan-reponse-incidents",null,"Jku90x0C5bG0mNAEevkZwQBP0Cen1ycFSAIiAOda4hM",{"path":639},"\u002Fblogue\u002Fplan-reponse-incidents-pme-modele",[641,649,657],{"path":642,"title":643,"description":644,"category":205,"minutes":27,"tags":645},"\u002Fen\u002Fblog\u002Fbusiness-continuity-plan-cyberattack","Business Continuity Plan After a Cyberattack: A Template","Critical processes, RTO and RPO, manual workarounds: a practical business continuity plan template so your small business keeps serving clients after an attack.",[646,632,647,648],"business continuity","small business","planning",{"path":650,"title":651,"description":652,"category":205,"minutes":23,"tags":653},"\u002Fen\u002Fblog\u002Fexternal-vs-internal-penetration-test","External vs Internal Penetration Test: Which Comes First?","External vs internal penetration test: what each reveals, typical cost ranges and which to start with for your small business, plus a prep checklist.",[654,655,656,634],"pentest","network","active-directory",{"path":658,"title":659,"description":660,"category":205,"minutes":27,"tags":661},"\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit","Google Workspace Security Audit: 12 Settings to Check","A Google Workspace security audit checklist for small businesses: super admins, 2-Step Verification, Gmail, Drive sharing and third-party app access.",[662,663,205,634],"google-workspace","cloud",1792972905739]