Incident Response Checklist for Small Businesses: First 24 Hours After a Cyber Attack

A ransom note scrolling across the office printer. A file server that suddenly asks for a password nobody set. An accountant who can't open the payroll folder two days before payday. The first sign of a cyber attack rarely looks dramatic — it looks like a glitch, and that is exactly why the first hour usually gets wasted. What you do in the next 24 hours decides whether this stays a bad week or turns into a bad year: whether the attacker keeps a foothold in your network, whether your backups survive, and whether you can tell customers, insurers, and regulators what happened with a straight face. This checklist is written for teams of two to fifty people, with no security department and nobody sitting around with spare time.

Minute one: contain, don't clean

Your instinct will be to fix things. Resist it. Cleaning a machine destroys the evidence you will need and often tips the attacker off that you've noticed.

Isolate affected systems from the network. Pull the ethernet cable or disable the Wi-Fi adapter rather than hitting the power button — a machine that stays running keeps useful information in memory, while a powered-off machine keeps almost nothing. If files are visibly encrypting before your eyes, or you can't reach the cable quickly, shut it down. Speed beats elegance.

At the same time: disable remote access (VPN, remote desktop), pull shared drives offline, and lock down any accounts you know are compromised. Don't announce the problem over company email if email is part of the suspect infrastructure — use phones or a group chat on personal devices.

Put one person in charge, and write everything down

Small teams fail at incident response in a predictable way: everyone starts typing at once. Assign four jobs in the first fifteen minutes.

• Incident lead. Makes decisions. Does not touch a keyboard. If you are the owner, this is probably you — and your job is to say yes or no, not to investigate.
• Technical hand. Does the isolation, log collection, and recovery work.
• Scribe. Keeps a timestamped log. "14:20 — accounting PC unplugged from switch port 12." Boring, and worth its weight in gold later.
• Communicator. Handles staff, customers, insurer, and lawyer so the lead isn't juggling calls mid-crisis.

One person can hold two roles in a team of four. Nobody should hold all four.

Preserve evidence while you contain

Evidence is what gets your insurance claim paid and what tells a forensics firm how the attacker got in. Capture it before you rebuild anything.

• Photograph screens, including the ransom note. Photograph it — do not click links in it, and do not reply.
• Export logs from your firewall, VPN, email provider, and antivirus or endpoint tool. Export them off the affected machine.
• Copy suspect disks to an external drive before wiping or reinstalling, if you have the storage and the time.
• Keep a chain-of-custody sheet: which drive, who handled it, when, and where it's stored.

Check your backups early, but don't reconnect them to the network to test them until you know how the intruder got in. Attackers go after backups first because that's what forces companies to pay.

Communicate in the right order

Call your cyber insurer and a lawyer before you call customers. Insurance policies typically require prompt notice, and legal counsel can guide you on what you are obliged to disclose and when. Many industries and jurisdictions have breach notification rules with deadlines measured in days, not weeks, so this is not a decision to make alone — get professional advice before you send anything public.

Then brief your staff with a short, honest message: what to do, what not to do, and who to contact. Tell them not to discuss the incident on social media or with clients.

Customers deserve plain language if their data is involved. Say what you know, what you don't yet know, and when you'll update them next. Do not speculate about the cause and do not claim that no data was taken before someone has actually verified it. That sentence has ended more companies' reputations than the breach itself.

Close the doors the attacker used

Containment is not recovery. Once systems are isolated, work through the access paths:

1. Reset passwords on every privileged and email account, then revoke active sessions and tokens — a password change alone doesn't kick an attacker out of a live session.
2. Turn on multi-factor authentication everywhere it isn't already, starting with email, VPN, and admin panels.
3. Look for accounts you didn't create, mail forwarding rules you didn't write, and scheduled tasks you don't recognise.
4. Rebuild compromised machines from scratch. Cleaning malware off a machine you can no longer trust is optimism, not security.
5. Rotate credentials shared with your IT provider, accountant, or any other third party.

The first 24 hours, hour by hour

• 0–30 minutes: isolate, assign roles, start the log, photograph the ransom note.
• 30–60 minutes: call insurer and counsel, disable remote access, stop backups from being overwritten.
• 1–4 hours: determine scope, export logs, verify backup integrity offline, brief staff.
• 4–12 hours: send required notifications with legal guidance, begin rebuilding on clean infrastructure, rotate credentials.
• 12–24 hours: confirm nothing has reappeared, watch for unusual logins, give customers and staff a status update, and plan the next three days.

Day two, and the parts nobody thanks you for

Write the full timeline while it's fresh. Keep the evidence sealed and labelled even if everything is back online. Watch your logs for a week for the same accounts and IP ranges — attackers frequently return, and a quiet network on day three is not proof you're clear.

Then do the thing that actually reduces your risk: run a two-hour tabletop exercise with your team. Pick a scenario — a locked file server, a fraudulent invoice sent to a client — and walk through who calls whom. You will find three gaps in your plan in the first twenty minutes.

Print this checklist, fill in names and phone numbers, and keep a copy somewhere that doesn't require the network to reach it. The worst moment to look up your insurer's policy number is while your email is down.

Photo: Tima Miroshnichenko / Pexels