A 55-person SaaS company gets a Slack alert at 3:47 AM: an EDR flagged a ransomware precursor on an admin's laptop. Within 90 seconds the security-on-call had isolated the laptop, opened an incident, notified the CEO by pre-agreed SMS, and paged the outside DFIR firm on retainer. By 5:30 AM the scope was known (one laptop, no lateral movement, no data exfil), the credentials involved were rotated, and the customer-facing systems were confirmed clean. Total wall-clock: 103 minutes. Total customer impact: zero.
That's what a real incident response plan buys you. The company had one because it wrote one. The plan was six pages, tested twice a year in tabletop exercises, and pinned to a Slack channel every incident owner had bookmarked.
Most SMBs and mid-market companies don't have a plan like that. Not because they don't want one — because enterprise IR frameworks assume you have a SOC, a CISO, a legal team, and a DFIR retainer already in place. If you're 20-200 employees, that's not your reality. This guide covers what actually works at your scale, mapped to the NIST SP 800-61 Rev 2 framework, with the runbook template you can use as a starting point today.
What an incident response plan actually is
An incident response plan is a document that answers one question: when something goes wrong, who does what?
Not a 200-page compliance binder. Not a checkbox for the SOC 2 auditor. A clear set of pre-made decisions so nobody's making them for the first time during a crisis — when every minute costs money and every wrong move makes it worse. The best IR plans are 6-12 pages, live in the same repo as the code, and get updated after every incident and every quarterly tabletop.
Six pages. Names, not titles. Cell numbers, not org-chart references. A one-page runbook for each of the top 5 attack scenarios. A named backup for every role. One outside firm on retainer for DFIR support. Two tabletops per year. That's the delta between the companies that survive a real incident and the ones that don't.
The NIST SP 800-61 Rev 2 framework, at SMB scale
NIST SP 800-61 Rev 2 (Computer Security Incident Handling Guide, most recent update Aug 2012 with Rev 3 draft released 2024) is the reference framework every mature IR program builds on. It defines four phases; here's how each maps to what a 30-person or 100-person company can actually execute:
Every phase compresses at SMB scale. That's the point. You're not doing less work than the enterprise — you're doing the same work with a smaller footprint. The document is shorter. The team is smaller. The runbooks are tighter. But every phase still runs.
The six things your plan needs to cover
1. Named people, cell numbers, backups
You need names, not titles. "The IT person" isn't a plan — it's a hope. Write down exactly who gets called first, who makes the call to shut things down, and who talks to customers. In a small company, one person often wears multiple hats. That's fine. Just make it explicit, put cell numbers in the plan, and name a backup for every role. During the last big MOVEit incident of 2023, the companies that recovered fastest were the ones where the incident commander was reachable by cell within 15 minutes of the alert firing.
2. Severity criteria that trigger the plan
Not every phishing email is a five-alarm fire. Your team needs clear criteria for what triggers the plan versus what gets handled in the normal course of business. The severity matrix below is the SMB-scale starting point — most companies use a 3-4 tier scale, not the enterprise 5-tier version:
3. Containment steps that work at 2 AM without thinking
The first priority in any incident is containment — preventing it from getting worse. This is where having decisions pre-made saves you. If a workstation is compromised, do you pull it off the network immediately? (Yes.) If a user account is breached, do you disable it before investigating? (Yes.) These feel obvious now. They won't feel obvious at 2 AM.
Do immediately (first 15 minutes)
- Isolate compromised endpoints from the network (via EDR agent, not by unplugging)
- Disable breached accounts + rotate their credentials + revoke SSO/MFA tokens
- Preserve logs, memory dumps, and disk images BEFORE they rotate — most EDRs have a "capture memory" button; hit it
- Notify your response team via a pre-agreed alternate channel (SMS, Signal — NOT the compromised email or Slack)
Do NOT do (yet)
- Don't wipe machines before forensics complete — you'll destroy the evidence you need to know what was taken
- Don't change passwords en masse before understanding scope — you'll tip the attacker and lose your best data source (their current access)
- Don't email the whole company — you'll trigger reporter tips and social-media chatter that makes containment worse
- Don't contact the press or make public statements until legal + PR have reviewed
4. Communication with a single spokesperson and legal-reviewed templates
Communication during an incident is where companies make their most expensive mistakes. Telling customers too early creates panic; telling them too late creates lawsuits and regulatory penalties. Your plan should spell out:
- Internal notification chain. Who tells the CEO, and when? Who tells the board? Who tells the rest of the company (and what they can share)?
- Customer communication triggers + pre-approved templates. If PII is exposed → notify within X hours. If credentials are exposed → force reset with the notification. Templates already legal-reviewed.
- Regulatory notification requirements. HIPAA requires notification within 60 days (45 CFR 164.404); GDPR Article 33 requires notification to supervisory authorities within 72 hours; state breach-notification laws vary widely (California, New York, and Massachusetts are the strictest). Your plan should have the specific timing for every framework you're subject to.
- Law enforcement + government reporting. FBI IC3 report (ic3.gov); CISA reporting per CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act, 2022 — reporting rules finalizing 2026); sector-specific ISAC notifications.
One person speaks externally — not the whole team. Written updates only, on a set cadence (e.g., every 4 hours during active incident). No speculation about cause or scope until investigation confirms it. Legal reviews all external communications before they go out. This is where a good vCISO earns their annual fee — they've written these templates a dozen times before.
5. Recovery with backup-restore verification and re-entry monitoring
Recovery isn't "turn the servers back on." It's verifying the attacker is actually gone, restoring from clean backups (backups that were verified to be uninfected via the timestamp of the compromise), monitoring for re-entry via the same or a new vector, and documenting every artifact. The 2023 MGM Resorts incident recovery took 10 days largely because backup-restore testing hadn't been done regularly — nobody knew which backups were clean until it was tested live during the incident.
6. Post-incident retro that changes something
The post-incident review is the most valuable part of the entire process — it's where you find the gaps that let this happen and close them before next time. Two rules: the retro is blameless (attack the process, not the people), and every retro produces at least one specific control or runbook change that gets shipped before the retro doc closes. Companies that skip the retro repeat the incident within 12 months at 3x the rate of those that don't (Gartner, "How to Design a Post-Incident Review Program", 2024).
The runbook: ransomware detonation walkthrough
A runbook is a one-page playbook for a specific scenario. Every mature IR program has 5-8 runbooks. Here's what a ransomware runbook looks like at SMB scale — this is the shape yours should take, tuned to your environment:
T+0 to T+15 min: Detection + isolation
EDR alert fires → on-call engineer confirms via console → EDR agent isolates the endpoint (network isolation, still reachable by admin console for forensics) → incident opened in ticketing system with SEV-1 tag → incident commander paged via SMS + PagerDuty → outside DFIR firm notified via retainer contact
T+15 to T+60 min: Scope + credential rotation
Incident commander convenes bridge call (Zoom + Signal for OOB comms) → DFIR firm confirms scope from EDR telemetry → any credentials that touched the endpoint in the last 30 days are marked for rotation → MFA tokens revoked for the endpoint user → cloud provider notified if the endpoint touched IAM roles
T+1 to T+4 hours: Containment + backup validation
Any lateral-movement indicators trigger isolation of adjacent systems → clean backup identified from before the earliest possible compromise timestamp → CEO + legal notified per plan → if customer data touched, PR + customer-comms drafts start (not sent yet)
T+4 to T+24 hours: Investigation depth + notification decisions
DFIR firm produces preliminary findings (attacker TTPs, initial access vector, data-exposure scope) → regulatory clock starts if applicable (72h for GDPR, varies for HIPAA/state laws) → legal makes the go/no-go call on customer notification → if going, pre-approved templates sent to affected customers only
T+1 to T+7 days: Recovery + hardening
Verified-clean backups restored to a clean environment → parallel monitoring on any workload that couldn't be rebuilt (look for re-entry) → root-cause vulnerability patched or compensating control added → all responder actions logged in the incident ticket for the retro
T+7 to T+14 days: Blameless retro + control changes
Retro convenes with all responders + one uninvolved reviewer → timeline reconstructed with EDR + SIEM logs → 3-5 concrete control changes identified (updated runbook, added logging, closed access) → each change assigned an owner + ship date → retro doc closed only when the shipped changes are verified
What a real IR program costs at SMB and mid-market scale
The most common over-purchase in SMB IR is buying enterprise SOAR (Splunk SOAR, Palo Alto XSOAR) at $100K+/yr for an environment that generates 20 alerts a week. SOAR is optimized for high-volume alert triage — an environment that fires alerts continuously. At 20 alerts/week, a $299-$1,499/mo platform-augmented vCISO with EDR + email security ML + a lightweight SIEM covers the actual work.
Where risk quantification fits the IR conversation
The hardest part of IR planning for SMBs isn't the technical procedures — it's knowing what to prioritize. When you have limited resources, you can't prepare equally for every threat. This is where putting risk in financial terms changes the game.
When you know that a ransomware attack on your specific business has an expected annual cost of $180K, but a vendor data breach is $45K, you know where to build the deeper runbook. When your board asks "are we prepared?", you can answer with numbers instead of confidence levels. FAIR-based risk quantification produces the dollar-denominated view of exposure that ranks the top 5 scenarios your runbooks should cover — not by threat actor sophistication, but by financial impact per event × probability per year.
No IR plan. Security was 'the IT lead handles it.' After a phishing incident led to a compromised email account with access to customer-onboarding data, response took 3 weeks and cost $340K (remediation + legal + notification + churn on 2 flagship accounts).
Built a focused 6-page IR plan covering their top 5 scenarios: ransomware, credential compromise + SSO abuse, vendor breach (Diamond/DC-TPIR framework), lost/stolen laptop, and insider misuse. Quantified risk exposure to prioritize — discovered biggest exposure was actually vendor access, not direct attack. Reduced expected response time from weeks to hours for covered scenarios.
Platform-augmented vCISO subscription ($1,499/mo — includes plan template, quarterly tabletops, and vCISO consultant time) + EDR on all endpoints ($120/user/yr) + email security ML ($5/user/mo bundled). Total: $32K/yr for the SMB IR program that would have prevented the $340K incident.
The IR plan template outline
The starting template. Every section should be 1-2 pages max. Total plan: 8-14 pages depending on how many runbooks you include:
- Section 1: Roles and contacts. Named people + cell numbers + backups. Update after every org change.
- Section 2: Severity matrix. The 4-tier table above, customized to your systems + data sensitivity.
- Section 3: Detection sources + triage flow. Where alerts come from (EDR, SIEM, email security, user reports); who triages; when it gets escalated.
- Section 4: Containment playbooks. The "do immediately / don't do yet" two-column view for each scenario type.
- Section 5: Communication plan. Internal chain + customer templates + regulatory clocks + legal-review requirement.
- Section 6: Runbooks (5-8 total). Ransomware, credential compromise, phishing-to-data-access, vendor breach, lost/stolen device, insider misuse, DDoS, business email compromise.
- Section 7: Recovery + validation checklist. Backup-restore verification steps, monitoring for re-entry, all-clear criteria.
- Section 8: Post-incident retro template. Timeline reconstruction, root cause, control changes, ownership + ship date.
- Section 9: Testing schedule. Quarterly tabletops with scenarios + facilitator + participant list.
- Appendix: Regulatory + industry-specific clocks. HIPAA, GDPR, state laws, PCI DSS, sector-specific requirements.
Testing the plan: the tabletop exercise
A written plan you've never tested is barely better than no plan. The single highest-ROI security activity a growing company can do is a quarterly 90-minute tabletop exercise. Pick a scenario (ransomware on a critical system, admin credential compromise, vendor breach exposing customer data), walk through your plan with the incident-commander + IR team + one leadership observer, and find the holes. Every tabletop should produce 3-5 specific improvements to the plan or the runbooks. Do this quarterly and your plan gets sharper every 90 days.
Real IR programs test their plans. Checkbox IR programs write plans that live in a Google Doc that nobody opens between annual reviews. The delta between the two is measurable: organizations that run tabletop exercises quarterly detect + contain breaches in a fraction of the industry average time (SANS 2024 Incident Response Survey). It's a 90-minute meeting per quarter. Do it.
Bottom line
You don't need an enterprise security team to have a solid incident response plan. You need clarity about what matters most to your business (quantified in dollars, not colors), a small set of well-rehearsed runbooks, an outside DFIR firm on retainer for the technical depth you can't hire, and the discipline to test the plan every 90 days.
The technology piece is real but not the bottleneck. The 20-person SaaS that survives an incident does so because the plan existed, the people knew their roles, the retainer was in place, and someone had walked through this scenario in a tabletop three weeks ago. The 20-person SaaS that goes out of business post-breach does so because none of those things existed and every decision was being made for the first time under duress. There's no middle path.
Build the IR program without a full-time security lead
vCISO Lite publishes its rate card — $299 to $1,499 per month across four tiers. Every tier includes an IR plan template scaled to your headcount, quarterly tabletop facilitation, and a fractional vCISO who runs the seven-function security operations program end-to-end — including incident response as one of the seven. Purpose-built for the 33 million US small and mid-sized businesses that don't have a CISO yet.
If you're writing your first IR plan, updating one that was written for a much smaller company, or debating whether a $60K/yr enterprise IR platform makes sense at your size, visit vcisolite.com to learn more and get started.
Sources
- NIST SP 800-61 Rev 2, Computer Security Incident Handling Guide (Aug 2012 — the base framework this article aligns to; Rev 3 draft was released for public comment 2024): nvlpubs.nist.gov/NIST.SP.800-61r2.pdf
- IBM Cost of a Data Breach Report 2024 (277-day identify-plus-contain average; $1.9M savings with tested IR + automation): ibm.com/reports/data-breach
- Accenture 2024 State of Cybersecurity Report (43% of attacks target SMBs; only 14% have security controls to defend — n=3,000 CISOs): accenture.com/insights/security
- Verizon 2025 Data Breach Investigations Report (22,052 incidents analyzed, ransomware share 88% at SMBs, median ransom $115K): verizon.com/business/resources/reports/dbir
- ConnectWise State of SMB Cybersecurity 2024 (78% of SMBs concerned severe cyberattack could put them out of business — n=700 SMB owners): connectwise.com/state-of-smb-cybersecurity
- CISA Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) 2022 — reporting rules finalizing 2026 for covered entities: cisa.gov/circia
- SANS 2024 Incident Response Survey (tabletop-exercise cadence + detection/containment time correlation): sans.org/white-papers
Where this matters next
Why Your 50-Person Company Needs an Incident Response Plan — the case for building an IR plan before you need it — with the SMB-specific breach data that makes the ROI defensible.
Business Continuity and Disaster Recovery for Startups — IR is the first 24 hours; business continuity is what happens next — the two plans are related but distinct, and most companies conflate them until something breaks.
Someone Else's Breach: Why Vendor Incident Response Is Its Own Discipline — the DC-TPIR framework for when the incident is at a vendor, not you — different playbook, different clocks, different decision criteria (stay / exit / mitigate).
Are We Affected? The Sixty-Minute Triage for Vendor Incidents — the tactical runbook for the vendor-incident case — the three questions to answer inside an hour, and the five artifacts to gather.
Security Operations Playbook 2026 — the seven-function playbook IR sits inside — one function, not a program of its own.
Platform: Security Testing — the pen test + tabletop exercise surface — where quarterly IR tabletops get scheduled and run inside the platform, with the vCISO facilitating.
Use Case: Build Your Security Program — how the fractional vCISO tier delivers the seven-function security operations program including IR at SMB pricing.
Platform: Published Pricing — vCISO Lite's published rate card — $299 to $1,499 per month, four tiers, each with an IR plan template and quarterly tabletop facilitation bundled.