Contents
Short answer
A one-page incident plan with responsibilities, a contact list and first steps often helps small businesses more in an emergency than any extra tool. Add an overview of which providers have access, a fallback mode for critical processes and clear, risk-based rules for AI tools.
Why does this matter for small businesses?
During an incident there is no time to sort out responsibilities or look up phone numbers – especially when email and files are unavailable. Small businesses also depend heavily on IT providers and software vendors, and AI tools create new routes for confidential data to leave the business.
- Detect
- Contain
- Recover
- Learn
What does it include?
Incident response
Define first steps: scope, isolate, preserve evidence, get help.
Useful as IT grows
Crisis plan and responsibilities
Who coordinates, who decides, who communicates? With deputies.
Useful as IT grows
Contact lists
IT provider, bank, insurer if applicable, data protection contact – also available offline.
Basic
External IT providers and suppliers
A list of who can access what, which security commitments exist and how to reach them in an emergency.
Relevant with higher risk
Business continuity
Name critical processes and define a fallback mode, such as manual invoices or a paper phone list.
Relevant with higher risk
Awareness
Short, regular formats on phishing, payment fraud and reporting routes.
Useful as IT grows
Generative AI
Risk-based rules instead of blanket bans: which tools are approved, which data may go in, who checks outputs?
Useful as IT grows
What does it protect against?
- Chaos and lost time during an incident
- Unclear responsibilities with providers
- Unintended leakage of confidential data via AI tools
What does it not protect against?
- The incident itself – the plan limits consequences
- Plans nobody knows or has practised
- Legal assessment of individual cases
Which basic measures are often enough?
- 01One-page incident plan with contacts, stored offline
- 02List of all providers with access
- 03Short AI policy: approved tools and forbidden data types
- 04Walk through the plan together once a year
When does a more advanced solution make sense?
With higher IT dependency, a retainer with an incident response provider, a documented business continuity plan, security requirements in supplier contracts and tabletop exercises become worthwhile. Using AI with customer or staff data calls for reviewed contract terms and possibly data protection advice.
A simple cyber incident plan for small businesses
This structure fits on one page. Fill in the details in your own document, print it and keep a copy offline.
- Person in charge
- Name, role, how to reach them
- Deputy
- Name, role, how to reach them
- Internal IT contact
- Who knows the systems?
- External IT provider
- Company, emergency contact, contract number
- Insurer contact, if any
- Claims hotline, policy number
- Key systems
- e.g. accounting, inventory, shop
- Key cloud services
- e.g. email, file storage, banking
- Backup responsibility
- Who checks and restores?
- Communication responsibility
- Who informs staff, customers, partners?
- Escalation path
- Who is informed in which order?
- Relevant contact details
- Bank, data protection contact, hosting, domain registrar
Common mistakes
- Keeping the plan only on the server that gets encrypted
- IT provider contacts only in the mailbox
- Banning AI outright – encouraging uncontrolled use
- Giving providers permanent full access
Checklist
- Incident plan exists and is available offline
- Owners and deputies named
- Provider list with access rights current
- Fallback mode for critical processes described
- AI rules written down and known
Frequently asked questions
How detailed must an incident plan be?
One page is enough to start: who is in charge, whom do we call, what do we do first. Everyone knowing it matters more than length.
Should we ban AI tools?
Blanket bans often lead to hidden use. Better: name approved tools, exclude sensitive data types and have outputs checked.
Must every incident be reported?
No. Whether a reporting duty applies depends on the case. Seek professional advice if unsure.
Sensible next step
Write one page with owners, contacts and first steps, and keep a printed copy.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- Allianz für Cyber-Sicherheit (BSI)
- ENISA – European Union Agency for Cybersecurity
- NIST Cybersecurity Framework
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.