A cyber attack can leave a small business dealing with several problems at once. Someone needs to investigate, staff need instructions, customers want answers and normal work may have stopped.
Responding to a cyber attack means keeping those jobs connected. Restoring a working screen doesn't, by itself, show that an attacker has lost access or that your records are reliable.
If you've just discovered an incident, start with our first-hour cyber attack checklist for urgent calls and containment decisions. This guide covers the work that follows, from organising the response to deciding when services can safely return.
Give the response a clear owner
Choose one incident lead who can approve business decisions, with a deputy and someone recording actions. Bring in your IT provider or a competent incident-response specialist early. Check your insurer's notification and approved-provider arrangements if you have cyber cover. Contact your bank immediately if money or payment instructions may be affected.
Agree who can isolate systems, contact customers and authorise recovery. Put the next meeting time in the incident record so everyone knows when decisions will be reviewed.
Containment needs judgement. Disconnecting an affected device may limit an attack but won't necessarily stop malicious activity already running. Shutting it down can lose evidence. Follow specialist advice, taking account of safety and essential services, rather than applying a blanket shutdown or wipe instruction. The NCSC's immediate response guidance explains these trade-offs.
Make a usable record of what is happening
Start with three headings: confirmed facts, questions to investigate and decisions taken. Record times consistently, including the time zone.
An imagined entry might read: “10:20 BST, two colleagues reported messages they didn't send. IT asked to check mailbox access. Customer impact not yet established.” That gives the next responder something useful without turning suspicion into a conclusion.
The NCSC's questions for identifying an incident help establish which services, people and information may be affected. Add the owner and status of each investigation question to your record.
Ask the responder how to preserve original messages, relevant logs and affected equipment. Avoid deleting suspicious material or experimenting on compromised devices. Restrict access to the incident record because it may contain sensitive information about the business and other people.
Decide what the business needs to do first
Write down the smallest set of activities needed to operate safely. That might include contacting customers about missed appointments, meeting payroll or processing orders already promised.
For each activity, identify the systems and people it depends on. Recovering the order database won't help much if nobody can securely sign in or confirm delivery details.
Temporary arrangements need approval too. For example, if staff record orders on paper, decide who stores them, who enters them into the restored system and how duplicates will be prevented. Don't let an emergency workaround become an untracked second set of business records.
Run reporting decisions alongside the investigation
The person handling reporting should not have to wait for the technician to finish every check.
Under the ICO's personal data breach guidance, a controller must notify the ICO of a personal data breach unless it is unlikely to risk people's rights and freedoms. Notify without undue delay and, where feasible, within 72 hours of becoming aware. This is not 72 hours from finishing the investigation. Missing details can follow in phases without undue further delay.
If the breach is likely to cause a high risk, affected people must also be informed without undue delay, subject to applicable exceptions. Keep a record even if notification isn't required. A processor must tell its controller without undue delay. Get qualified advice promptly where the assessment is unclear.
For a business under a live cyber attack in England, Wales or Northern Ireland, Report Fraud says to call 0300 123 2040 immediately. In Scotland, contact Police Scotland on 101 for non-emergencies. Call 999 if someone is in immediate danger.
Significant incidents can also be reported to the NCSC. Check separate insurer, contractual and sector reporting duties. An NCSC report does not fulfil them.
Give people information they can use
Appoint someone to coordinate updates through a communication channel you have reason to trust. If the attacker may control company email, agree another route with your responder.
Each update should say which services are affected, what people should do and when they will hear more. Be clear about what remains unknown. Don't promise that no data was accessed before the evidence supports that statement.
The NCSC's communications guidance stresses accurate, timely messages for different audiences. A customer needs to know how an order is affected. A colleague needs to know which systems they may use. Neither needs a copy of sensitive investigation notes.
Agree checks before bringing services back
Ask the responder and service owner to agree what evidence is needed before reconnecting each service. A practical recovery record could cover:
- What is known about the route in and the action taken to close it.
- Whether affected accounts, sessions and other access have been addressed.
- Which backup will be used and how its suitability has been checked.
- Who will check recovered records and carry out a safe business test.
- What monitoring and escalation arrangements will follow reconnection.
- Who approved the remaining risk and any restrictions on use.
The NCSC's recovery guidance warns that recovery can restart an incident if the attacker still has access. A successful restore or a quiet antivirus screen is not enough evidence on its own.
Turn the review into specific changes
When the business is stable, ask what slowed the response and what made it easier. The NCSC's rebuild guidance includes learning from the incident and supporting the people involved.
Avoid ending with “improve security”. Write an action someone can complete, such as updating the emergency contact sheet or checking who receives account alerts. Give it an owner, a deadline and a way to confirm it worked.
Use those findings to update your cyber security risk assessment and regular maintenance checks. Keep unresolved questions visible after normal trading resumes, so they don't disappear with the last incident meeting.