Effective Cyberattack Response: What Small Businesses Should Do First

Confirm the signal and activate the plan

Record what was observed, when it began, who reported it, and which systems or accounts may be involved. Treat ransom notes, unusual sign-ins, unexpected MFA prompts, disabled security tools, encrypted files, fraudulent payment requests, and unknown administrator accounts as potential incident signals.

Notify the person authorized to lead the response. Use a known-safe communication method if company email or collaboration tools may be compromised.

Contain affected access without destroying evidence

Isolation limits spread while preserving options. Disconnect a suspected endpoint from Wi-Fi, Ethernet, VPN, and shared storage when your response lead directs it. Disable a confirmed compromised account through an unaffected administrative system. Do not randomly power off servers, delete suspicious files, or run unapproved cleanup utilities.

• Document each action and the person who approved it.
• Preserve screenshots, timestamps, alerts, emails, and affected equipment.
• Avoid using a potentially compromised device to discuss the incident.

Establish scope and business priorities

Determine which identities, endpoints, applications, locations, data sets, and vendors are affected or at risk. Ask whether the attacker may still have access, whether sensitive data was viewed or removed, and whether backup systems were reached.

At the same time, identify the business processes that cannot safely operate. Payroll, payment approvals, customer communications, manufacturing, scheduling, and regulated records may require different recovery priorities.

Coordinate insurance, legal, regulatory, and law-enforcement decisions

Cyber-insurance policies often specify notification procedures, approved providers, and consent requirements. Legal counsel can help determine notification duties and preserve privilege where appropriate. Regulatory and contractual obligations vary by industry, location, affected data, and customer agreements.

The Cybersecurity and Infrastructure Security Agency provides official guidance for small-business cyber incidents. Ransomware victims can also review CISA’s ransomware response guidance.

Remove attacker access and correct the entry path

Eradication should follow verified scope. Depending on the incident, the response team may revoke sessions and tokens, reset selected credentials, remove persistence, patch exploited vulnerabilities, rebuild systems from trusted media, rotate application secrets, or change vendor access.

Do not assume a password reset alone removes access. Identity sessions, OAuth permissions, forwarding rules, remote-management tools, service accounts, and cloud application integrations may also require review.

Restore in a controlled sequence

A cyberattack recovery plan should define restoration order before pressure builds. Confirm that backups are clean, validate the recovery environment, restore the most important business capability first, and monitor each phase before reconnecting additional systems.

• Verify identity and administrator access.
• Restore from known-good recovery points.
• Test applications, integrations, permissions, and security monitoring.
• Communicate what employees may use and what remains restricted.

Capture lessons and reduce recurrence

After stabilization, document the timeline, initial access path, affected assets, control gaps, decisions, costs, and recovery results. Assign owners and due dates for improvements. A useful review may address MFA coverage, administrator separation, email rules, endpoint monitoring, network access, backup isolation, vendor controls, training, and response documentation.

The purpose is not blame. It is to turn evidence from the incident into a smaller likelihood and impact of recurrence.