Cybersecurity Incident Response: How to Build a Plan That Protects Your Business

If you just discovered a cyberattack on your business, take a breath. Feeling panicked is completely normal, but you're far from alone. According to Verizon's 2025 Data Breach Investigations Report, ransomware was involved in 88% of breaches analyzed among small and medium-sized businesses. This article walks you through exactly what to do right now, how to build a response plan for next time, and includes a free downloadable template so you're never starting from scratch again.

What Is a Cybersecurity Incident Response?

A cybersecurity incident response is the process your business follows to detect, contain, and recover from a cybersecurity incident. A cybersecurity incident generally refers to an event that jeopardizes or may jeopardize the confidentiality, integrity, or availability of information or information systems, or otherwise violates an organization's security policies or practices.

Common Types of Incidents Small Businesses Face

There are many ways a business may be targeted for a cyber incident.

Large and small businesses alike should be aware of these most common incident types:

• Phishing and Email-Based Attacks: Employees click malicious links or attachments that expose credentials or install malware, a mistake that costs small businesses millions each year.
• Ransomware: Employees open disguised attachments, like fake invoices, that lock down systems until you pay a ransom, often costing more to recover from than the ransom itself.
• Password-Based Security Breaches: Reused passwords let a breach on one account, like personal social media, become an opening into your business systems.

There are many othertypes of incidents out there that businesses may not be aware of. The first step to protecting your business is becoming aware of the possibilities. You may also want to consider cyber liability insurance. Depending on the policy and circumstances, cyber insurance may provide coverage for certain costs associated with responding to a cybersecurity incident.

What to Do in the First 24-48 Hours After a Cybersecurity Incident

For businesses without an in-house team, it may be difficult to decide where to start once an incident occurs.Instead of panicking, consider established guidance, such as NIST SP 800-61 Rev. 3, which aligns incident response with the NIST Cybersecurity Framework 2.0 and emphasizes preparation, detection, response, recovery, and continuous improvement.

• Identify and Contain the Threat: The first move should always be to detect the source of the incident and respond to it immediately.
• Assemble Your Response Team: Proactively assign roles to a response team that can then be activated at a moment’s notice.
• Document Everything and Preserve Evidence:Keep appropriate records of the incident, including when it was discovered, actions taken in response, and other relevant developments. Take reasonable steps to preserve potentially relevant evidence. Documentation requirements may vary depending on the circumstances and applicable insurance policy.
• Involve IT, Legal, and Your Insurer: All departments involved should be kept informed on the situation and updated as necessary. This is especially true of your cyber liability insurance provider, who should be contacted immediately,in accordance with the policy's reporting provisions.

Navigating a cyber incident is stressful. Paychex has a team of HR business partners who can help you create a cybersecurity incident response plan that is specific to your business. Remember, acting quickly can make all the difference in your business's recovery and continuation.

How to Build a Cybersecurity Incident Response Plan

A cybersecurity incident response plan is a written, organization-approved document that lists the actions to take before, during, and after a cyber incident. A good plan starts with knowing the risks specific to your industry and preparing for the worst. It also puts that process in place before you need it.

1. Define Roles and a Response Team

Decide your response team in advance. Include who will respond to incidents, who will inform the insurer, backups for those initial responders, and a contact tree of individuals responsible for each area. Choose people who are experts in their areas and able to handle the pressure of this type of incident.

2. Set Severity Levels and Playbooks

Prepare for incidents of every severity, from malware containment and ransomware recovery to fraud loss and a phishing-driven breach. A ransomware attack calls for a different response than a stolen password, so your plan should set security levels based on the type of incident, how many people it affects, and how to respond to each one.

3. Prepare Your Communication Templates

Prepare communications in advance so you can reach impacted employees, customers, or partners the moment you need to. If your cyber liability policy includes PR/crisis management support, having them review your communications can help you respond better than drafting messages under pressure.

4. Plan for Recovery and Business Continuity

Once you've addressed the threat, turn your attention to recovery and getting operations back to normal. Business interruption coverage exists precisely for this stretch, replacing income lost while you're offline and covering the cost of restoring your systems and data.

5. Review After Every Incident

After an incident, review your plan and assess it for weaknesses or improvements you can make before the next one. This should include reviewing your cyber liability policy to see what was covered and whether more coverage may be necessary.

The People Side: Who to Notify, and When

Once the cyber incident has been identified and your internal team notified, your next order of business is to inform any impacted parties.

Notifying Your Employees

Employees need two kinds of notice:

• Operational:What's down, what to do differently today, and whether payroll or direct deposit could be delayed.
• Legal:If Social Security numbers, bank details, or personal records were exposed, employees are affected individuals like your customers, which triggers the same state notification laws, deadlines, and often credit monitoring or identity-theft protection.Legal counsel can help determine applicable notification requirements and deadlines and whether services such as credit monitoring or identity-theft protection are required or appropriate.

Give employees a point of contact for questions and consider an EAP referral. Log who confirmed each notification, when, and how, since it ties into your documentation from earlier and matters for compliance and insurance claims. If your workforce is unionized, check your collective bargaining agreement too, since it may have notice provisions of its own.

Notifying Customers and Partners

If customers or business partners are affected, determine whether and when notification is required or appropriate based on the circumstances, applicable law, contractual obligations, and guidance from legal counsel. When notification is appropriate, clear and timely communication can help affected parties understand what occurred, what steps are being taken, and any actions they should consider.

Understanding Breach-Notification Obligations

Notification requirements vary by state and situation, so confirm your exact obligations with legal counsel before anything goes out. Budget for the cost too. Notification often involves mailing, call-center support, and credit monitoring, which is exactly the kind of expense many businesses don't realize they need coverage for until they're paying it out of pocket.

How to Keep Your People (and Their Payroll) Protected

Your payroll and HR systems hold some of your business's most sensitive data, including employee Social Security numbers, bank account details, and personal records, which makes them a prime target during any cybersecurity incident. Apply the same safeguards to your payroll platform that you use elsewhere: multi-factor authentication, limited access, and regular software updates. For a full walkthrough of where your business is most exposed, see our risk assessment guide.

A cybersecurity incident doesn't pause your payroll calendar. If it hits mid-cycle, you'll need a backup way to get a scheduled payroll run out on time, and tax deposit deadlines still may apply even while you're managing a breach. Background-check results and benefits-enrollment records are also a different data category than customer data, and their exposure often triggers separate notification requirements.

Businesses using a PEO should understand how cybersecurity and incident-response responsibilities are allocated between the business and the PEO. Responsibilities may depend on the affected systems and data, contractual terms, services provided, and applicable law. Businesses should maintain current escalation contacts and understand applicable incident-reporting procedures before an incident occurs.