Incident Response Basics for Small Businesses: What to Do Before You Need To

Ask most small-business owners for their incident response plan and you will get a pause, not a document. That is normal, and it is exactly what turns a bad day into a much worse week when something actually happens. A lost laptop, a phished mailbox or a misdirected email all demand decisions quickly, and quick decisions are far better when they were made in advance.

The plan does not need to be long

A workable plan is short enough that people will read it. It answers a handful of questions in plain language:

• Who is called first? Name one person and one backup, with mobile numbers that work after hours.
• Who can take a system offline? Decide now who has the authority to disable an account or pull a computer off the network without asking permission.
• Who talks to clients, regulators and insurers? One voice prevents contradictory messages.
• Where is the log kept? Someone writes down what was noticed, when, and what was done, in order. Memory is unreliable under stress.
• Who is the outside help? Write down your IT provider, your attorney and your insurance carrier's claims line before you need them.

The value is not the document itself. It is that everyone already knows their role before adrenaline is involved. If you are a tax preparer, note that the FTC Safeguards Rule requires a written incident response plan for many covered firms (firms holding information on fewer than 5,000 consumers are exempt from that part). Ask your advisor; either way, it is good practice.

Step zero: know what you are protecting

You cannot scope a problem you cannot see. If a laptop goes missing, the first question is "what sensitive data was on it?" Without a current inventory, the honest answer is "we are not sure," and that uncertainty is expensive. Offices that already know which Social Security numbers, payment card numbers or health-related files sit on which computer can describe an incident accurately. Offices that do not tend to guess, and guessing leads to telling too many people or too few.

A four-part response, in order

1. Contain. Isolate the affected device or account. Change passwords, sign out active sessions, and disconnect a suspect computer from the network. Do not wipe it yet; you may need it to learn what happened.
2. Assess. Work out what data was involved, how sensitive it is, and roughly how many people could be affected. Write down what you know and what you do not.
3. Notify. Depending on the facts, that may include affected people, state regulators, your insurer and others. Breach-notification rules differ by state, so involve your attorney and check the current law for the states where your clients live.
4. Remediate. Fix the gap that allowed the problem, then check that it is actually closed. A second look after the fix is what turns "we think it is handled" into evidence.

Where a scan helps

MyVaultMate does not respond to incidents, and it moves or deletes nothing on its own. What it does is shorten the Assess step. Its recurring scans find Social Security numbers, ITINs, payment card numbers, labeled license, passport and date-of-birth values, and a health-information keyword signal, then rank findings from Critical to Low by computer and record the compliance frameworks involved. Because the files and full values never leave the machine, the dashboard shows file paths, data types and short redacted samples such as ***-**-1234. Detection is rule-based, so expect an occasional false alarm and review findings rather than treating them as final.

What to do this week

• Write the one-page plan above and print a copy; a plan stored only on a compromised computer is no help.
• Do a ten-minute walk-through: "A laptop was stolen from a car. What do we do first?"
• Make a list of which computers hold client data, and confirm that disk encryption is on for each.
• Save your IT provider's and attorney's numbers somewhere that does not depend on your network being up.

This is general education, not legal advice. Your attorney or advisor can tell you what applies to your office. You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).