Fundamentals
A one-page cyber incident plan for small teams
A one-page cyber incident response plan template for small teams, based on ASD's guide: who decides, who to contact, how to communicate and keep trading.
Where to start: a one-page cyber incident plan
ASD's small business guide describes an emergency plan that answers four questions: how staff report, who to contact, how people are told and how the business keeps running. Filling in these blanks covers them.
- Name an incident lead and a backupWrite down who makes decisions during an incident, their mobile number, and who takes over if they're unavailable.Who decides
- Agree how staff report a problemASD's plan asks how staff report potential incidents. A phone call to the incident lead still works if email is affected.How staff report
- List who to call, with numbersThe bank, the IT provider, ASD's Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371, 24/7) and IDCARE's small business line on 1800 595 170.The contacts table
- Decide who tells customers, suppliers and staff, and howASIC describes warning customers and suppliers as soon as practicable, and contacting anyone personally targeted through verified channels.Informing people
- Note the systems the business trades on, and the workaroundsRecord the minimum systems and data the business needs, manual workarounds, and where backups are and who can restore them.Keeping the business running
- Print the plan and walk staff through itASD's guide describes keeping a hard copy in case systems are offline, and making sure staff know the plan and their roles.Keeping the plan usable
Based on ASD's Small business cyber security guide (January 2025), ASD's contact and ransomware pages, ASIC's guidance for scammed businesses and IDCARE's contact page, checked October 2026.
Key points
- ASD's ransomware recovery steps start with recording what's on screen (a photo works) and then turning off the infected device.
- ASIC says: "If a scammer asks you to pay a ransom, never do so." ASD says paying gives no guarantee of getting information back.
- ASD's ransomware recovery page says to restore from a backup only when confident it's free from ransomware.
- Organisations covered by the Privacy Act 1988 must notify affected people and the OAIC of a data breach likely to cause serious harm, the OAIC explains.
The Australian Signals Directorate’s (ASD) small business cyber security guide says: “An emergency plan could reduce the impact of a cyber attack on your business.” It describes a plan that defines how staff report incidents, who to contact (such as IT professionals and the bank), how staff, stakeholders or customers will be informed, and how the business continues if critical systems are offline. business.gov.au’s cyber security checklist describes an emergency management plan in similar terms.
This page sets out a one-page cyber incident response plan template built around those elements, plus the first actions official sources describe if something goes wrong. Copy the headings into a document, fill in the blanks and print it. It’s an educational starting point, not a full incident response plan or professional advice.
If an incident is happening now, go to what official sources describe as first actions or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
The template
The headings below follow the elements ASD’s guide describes. The blanks are for the business to complete.
1. Who decides
- Incident lead: name and mobile number.
- Backup: who takes over if the lead isn’t available.
2. How staff report an incident
- Who staff tell, and how (for example, a phone call to the incident lead if email may be affected).
3. Who to contact
| Who | Contact | Official source for this entry |
|---|---|---|
| Our bank | Number from the card or the bank’s official website | ASD’s guide lists the bank as a contact; ASIC lists reporting to the bank if money has been sent |
| Our IT provider | Name and number | ASD’s guide lists IT professionals as a contact |
| Australian Cyber Security Hotline | 1300 CYBER1 (1300 292 371), 24/7 | ASD’s contact page and ransomware page; ASIC’s guidance |
| IDCARE (small business line) | 1800 595 170 | IDCARE’s contact page; ASIC notes it’s free for sole traders and small businesses |
| Cyber insurer, if we have one | Policy number and claims line | business.gov.au’s checklist describes checking exactly what a policy covers; ASD’s ransomware steps mention checking reporting obligations to insurers |
| Key suppliers or platforms | Account and support numbers |
4. How we’ll inform people
- How staff will contact each other if systems are down.
- Who speaks to customers and suppliers. ASIC’s guidance describes warning customers and suppliers “as soon as practicable”, and contacting personally targeted customers “directly using verified communication channels”. This matters for business email compromise, where scammers may email customers from a compromised mailbox.
5. How we’ll keep operating
- The minimum systems and data needed to keep trading.
- Manual workarounds.
- Where backups are, and who can restore them. ASD’s guide warns that without regular backups, recovery after an attack may be impossible. See Microsoft 365 backup options if the business uses Microsoft 365.
6. Reporting
- ASIC’s guidance lists reporting to Scamwatch and reporting cybercrime through ReportCyber, which passes reports to the relevant police jurisdiction.
- The OAIC explains that under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. ASIC’s guidance says to “seek legal advice regarding reporting obligations”.
See where to report scams and cybercrime in Australia.
What official sources describe as first actions
These steps come from ASD’s ransomware recovery page (“I’m a victim of a ransomware attack. What should I do?”), ASD’s ransomware page and ASIC’s guidance for scammed businesses. Which ones apply depends on the incident.
- Recording details. ASD’s recovery page describes noting the ransom note, new file extensions and other changes, and says “a quick way to record the information you need is to take a photo of your screen”.
- Turning off the infected device. ASD’s recovery page says that once details are recorded, “turn off the infected device by holding down the power button or unplugging it from the wall”, and describes turning off other devices on the network too, starting with the most important.
- Contacting the bank and asking it to stop transactions if money has been sent (ASIC).
- Calling the Australian Cyber Security Hotline and contacting an IT professional for assistance (ASD ransomware page), and reporting through ReportCyber (ASD recovery page).
- Securing accounts. ASD’s recovery page describes changing passwords for important accounts first and turning on MFA. ASIC lists changing passwords, enabling MFA, signing out of “all other sessions and devices”, reviewing third-party app access and deleting unrecognised forwarding rules. If the business uses Microsoft 365, see the compromised account checklist.
- Not paying a ransom. ASIC says: “If a scammer asks you to pay a ransom, never do so.” ASD’s recovery page says “there is no guarantee you will regain access to your information”. See what ASD says about paying a ransom.
- Restoring carefully. ASD’s recovery page says to “only restore information from a backup if you are confident that it is free from ransomware”, and to get IT professional support if backups may be infected.
- Documenting what happened. For impersonation scams, ASIC describes documenting “the website URL/email address/social media handle, the date when it was first discovered” (ASIC).
Keeping the plan usable
ASD’s guide describes making sure staff know the plan, and keeping a hard copy in case systems are unavailable. business.gov.au’s checklist describes talking to staff about cyber security, and making formal training part of onboarding new employees.
To practise the plan, ASD’s free Exercise in a Box provides materials for discussion-based exercises, “often called a tabletop exercise”, and shorter micro-exercises, with a report template for recording what to improve. The business continuity basics guide covers testing in more detail.
Common questions
How do I write a cyber incident response plan for my small business?
A simple plan can follow the elements ASD’s small business guide describes: how staff report incidents, who to contact (such as IT professionals and the bank), how staff, stakeholders or customers will be informed, and how the business continues if critical systems are offline. The template uses those headings, with blanks for names and numbers. ASD’s guide also describes keeping a hard copy in case systems are unavailable.
What do I do if my business has a cyber attack?
Official sources describe a set of first actions, and which apply depends on the incident. ASD’s ransomware recovery page describes recording details, turning off infected devices and changing passwords for important accounts. ASIC lists contacting the bank if money has been sent, and ASD lists calling the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) and reporting through ReportCyber. See what official sources describe as first actions.
Who do I call after a cyber attack in Australia?
ASD’s Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371), available 24/7 according to ASD. IDCARE’s small business line is 1800 595 170, which ASIC notes is free for sole traders and small businesses. ASIC’s guidance also lists contacting the bank if money has been sent, and reporting cybercrime through ReportCyber. The who to contact table has space for these and the business’s own contacts.
Should I pay the ransom?
ASIC says: “If a scammer asks you to pay a ransom, never do so.” ASD’s ransomware recovery page says “there is no guarantee you will regain access to your information”. ASD’s page also describes restoring only from a backup known to be free from ransomware, with IT professional support if backups may be infected. See what ASD says about paying a ransom.
Do I have to report a cyber incident to the OAIC?
It depends on the business and what was affected. The OAIC explains that organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. ASIC’s guidance says to “seek legal advice regarding reporting obligations”. See reporting and the Notifiable Data Breaches scheme.
How do I test a cyber incident plan?
ASD’s free Exercise in a Box provides materials for discussion-based exercises, “often called a tabletop exercise”, and shorter micro-exercises, with a report template for recording what to improve. ASD’s guide also describes making sure staff know the plan. See keeping the plan usable, and business continuity basics for more on testing.
Where to get official help
- ASD’s Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), available 24/7 according to ASD.
- IDCARE’s small business line, 1800 595 170, per IDCARE’s contact page.
- ASIC’s what to do if your business has been scammed for the official steps after a scam.
- The OAIC’s Notifiable Data Breaches scheme page for data breach obligations.
Related reading: ransomware explained, business continuity basics and ten small business cyber security basics.