Cyber incident response for small business: prepare before the pressure arrives.

Decide who leads before an incident

Name the person authorised to coordinate the response and a deputy. Record how to reach your IT provider, cyber insurer, legal adviser and other specialist support without relying on the affected email or system.

Create a safe first-response sequence

• Confirm what has been observed and preserve notes.
• Contact the authorised technical responder before deleting, wiping or rebuilding devices.
• Contain affected accounts or connections where this can be done safely.
• Assess which business activities, customers and information may be affected.
• Use a trusted channel for staff and stakeholder updates.

Connect cyber response to continuity

If email, point-of-sale, booking, payroll or files are unavailable, the continuity plan should show the affected activities and approved alternatives. This link keeps the business response moving while specialists investigate the technical cause.

Know where to seek Australian help

The Australian Signals Directorate's Australian Cyber Security Centre publishes incident-response guidance and a Small Business Cyber Security Guide. Serious cyber incidents can be reported through ReportCyber. Privacy, contractual and regulatory notification requirements depend on the circumstances, so obtain appropriate advice.

Exercise the uncomfortable decisions

Walk through a realistic scenario: a compromised account, ransomware message or unavailable cloud service. Test who can authorise downtime, how customers will be told, where offline contact details are held and what evidence must be preserved.