A small organization may not have a security operations team, but it still benefits from knowing what to do when an account is compromised, a device disappears, or a suspicious message is opened. A short incident playbook helps people report concerns quickly and avoids improvised decisions under pressure. It should be tailored to the business, reviewed with its technology provider, and used alongside any legal, contractual, insurance, or regulatory reporting obligations that apply.
Name the first contact and backup
Choose an incident lead who can coordinate response and a backup in case the primary contact is unavailable. Give employees a reporting route they can reach if email or the normal collaboration tool is affected. Include a trusted technology provider, hosting support, and relevant account administrators. Store the contact sheet somewhere accessible outside the systems most likely to be disrupted, and make sure only the necessary people can change it.
Explain what employees should do first
Keep the first steps short: stop interacting with the suspicious item, report what happened, and preserve useful details such as the time, device, account, and message. Tell staff not to delete evidence, forward a suspicious attachment, or post incident details publicly. Provide a safe way to disconnect or turn off a device only if the incident lead or IT provider directs them to do so; the right response can depend on the situation.
List the systems and services that matter
Record the business accounts, devices, websites, payment systems, backups, and external providers whose disruption would affect customers or operations. For each, identify who can contact the provider and where recovery information is kept. Keep passwords and recovery codes in an approved secure manager rather than in the playbook itself. A current inventory helps the response lead decide what needs attention first and who can assist.
Plan communications and decision ownership
Decide who can authorize password resets, isolate an account, pause a service, contact customers, or engage outside advisers. Prepare a few neutral holding messages that can be adapted after facts are confirmed, and direct employees not to speculate. Record key decisions, times, and contacts in a protected incident log. For a serious event, involve qualified security, legal, insurance, or regulatory advisers as appropriate to the business and location.
Practice and update the playbook
Walk through a realistic scenario with the people who would respond, such as a lost laptop or a suspicious sign-in alert. Check whether the contacts work, whether the team can access the playbook, and whether the decision path is understandable. Revise the notes after a staff change, system replacement, or exercise. CISA’s small and medium business resources provide additional incident-response guidance that can help an organization shape a plan suited to its size.