How can small businesses prepare for a cyber security incident?

Preparing for a cyber security incident means making practical decisions before a problem occurs, so the business knows which systems matter most, who must be involved, what evidence and information are required, and how essential services can continue safely. Preparation should cover technology, people, suppliers, legal obligations and business priorities rather than relying on a single response document.

Start with a clear view of the business environment

A current inventory helps establish what could be affected. Record workstations, servers, cloud services, networks, mobile devices, applications, domains, administrator accounts and important data stores. The inventory should identify the owner or responsible team for each service, where information is held and which systems depend on it.

This is particularly important for small businesses using a mixture of office equipment, cloud platforms, remote access tools and outsourced services. An incident may not be limited to one computer; a compromised account, supplier connection or shared cloud service can affect several parts of the organisation.

Identify essential business processes

List the activities that must be protected or restored first, such as accepting orders, processing payments, serving customers, managing production, dispatching goods or accessing regulated records. For each activity, document:

• the systems and data it requires;
• the people or suppliers who operate it;
• the effect of losing access or integrity;
• acceptable workarounds, if any; and
• the information needed to decide whether the process can safely resume.

This business impact assessment supports sensible priorities. For example, restoring an email account may be less urgent than restoring a system used for orders or safety-critical operations, while a system containing sensitive information may require additional checks before it is returned to service.

Define what should be treated as an incident

Staff should know the difference between an ordinary technical fault and a possible security incident. Useful examples include an unexpected request for payment, a suspected phishing interaction, a lost device, an unfamiliar administrator account, unusual file changes, unexplained data access or a security alert involving a supplier.

Simple reporting instructions should tell employees what to record, who to contact and what not to do. They should not delete suspicious messages, reset affected devices unnecessarily or continue interacting with a suspected attacker unless instructed. Early reporting can provide useful context before logs or other information are lost.

Protect the information needed to investigate

Incident preparation should include suitable logging and monitoring for important systems. Consider which events need to be recorded, how long records should be retained, who can access them and how their integrity will be protected. Relevant records may include sign-in activity, changes to privileged accounts, security alerts, endpoint events, firewall activity and cloud administration actions.

Logging should be proportionate to the organisation’s size and risk. The aim is to make important activity reviewable, not to collect information that nobody can interpret. Confirm that alerts reach an appropriate person and that the organisation knows how to obtain records from cloud providers or other suppliers when required.

Prepare decision-making and communications

During an incident, different decisions may need to be made quickly, including whether to isolate a service, suspend an account, contact a supplier, notify customers or seek specialist advice. Establish who has authority for technical, operational, legal and communications decisions. Keep contact details accurate and include relevant internal staff, managed service providers, cyber security specialists, insurers, legal advisers and key suppliers where appropriate.

Prepare factual communication templates for employees, customers and suppliers, but do not assume that a standard message will suit every event. Communications should avoid speculation, identify what is known, explain any action required and be reviewed by the appropriate person before release. A separate record of decisions, times and approvals can help maintain a reliable account of events.

Review regulatory, contractual and insurance requirements

A cyber incident may create duties under data protection law, sector rules, customer contracts or supplier agreements. Identify in advance which types of event could require notification, who is responsible for assessing that requirement and where advice will be obtained. If personal data may be involved, consider the organisation’s obligations under UK data protection law and record the reasoning behind any notification decision.

Check cyber insurance conditions before an incident occurs. Policies may specify approved advisers, notification routes, evidence requirements or restrictions on taking certain actions. Contractual obligations may also require notice to customers, payment providers or technology partners.

Check external dependencies

Document how the organisation would contact critical suppliers if its usual email or telephone systems were unavailable. Confirm the support arrangements, security responsibilities and recovery options for hosted applications, connectivity providers, payment services and other important partners. Supplier contracts should make clear who manages security controls, logging, access and notifications.

Review remote access and privileged access arrangements as part of this process. Keep administrator accounts separate from ordinary user accounts, remove access that is no longer needed and ensure there is a controlled way to disable compromised credentials. These measures reduce the number of decisions required when an account is suspected of misuse.

Exercise the arrangements

A discussion-based exercise can reveal gaps without interrupting live systems. Use realistic scenarios such as a compromised mailbox, ransomware affecting shared files, a stolen laptop or an outage at a key supplier. Ask participants to work through the first decisions, dependencies, notifications and recovery priorities. Record unclear responsibilities, missing contact details and assumptions that need verification.

Exercises should lead to specific improvements, such as updating an asset record, changing an approval route, improving log access or clarifying a supplier’s responsibilities. Repeat the exercise when there is a significant change to systems, staff, premises or suppliers.

Use specialist support where internal capacity is limited

A small business does not need to manage every preparation task alone. A managed IT or cyber security provider can help review the technology estate, assess exposure, configure protective controls, improve monitoring and document practical procedures. S2 Technology Group supports businesses around Stourbridge, Kinver, Wordsley, Kingswinford, Kidderminster, Halesowen, Dudley and neighbouring areas with cyber security and managed IT services.

The most useful preparation is specific to the organisation’s systems and operating model. A generic checklist is a starting point, but effective preparation links security controls to business-critical processes, establishes clear decisions and confirms that the relevant people can act on reliable information.