How to Create a Basic Cyber Incident Response Plan

Why this matters

When a cyber incident happens, the first few hours matter most. Without a plan, people waste time working out who to call, may destroy evidence or make the problem worse. A simple written plan helps everyone act calmly and quickly.

Step-by-step instructions

1. 1

   Step 1

   Define what counts as an incident

   Give examples staff will recognise: ransomware messages, suspected compromised email, lost laptops, fake invoice payments or unusual account activity.

2. 2

   Step 2

   Assign roles

   Name a person who leads the response, who contacts the IT provider, and who handles communication with staff, clients and insurers. Include backups for each role.

3. 3

   Step 3

   List your key contacts

   Record phone numbers (not just emails) for your IT provider, cyber insurer, bank, legal adviser and the Australian Cyber Security Hotline (1300 CYBER1).

4. 4

   Step 4

   Write the first-response steps

   Keep it short and practical.

   • Disconnect affected devices from the network but leave them powered on
   • Do not delete emails, files or logs
   • Call the incident lead and IT provider
   • Change passwords from a clean device if accounts are affected
   • Contact the bank immediately if money has been sent
5. 5

   Step 5

   Cover notification obligations

   Note when you may need to notify the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, your insurer and affected customers.

6. 6

   Step 6

   Record where backups are and how to restore

   Document what is backed up, where, and who can restore it.

7. 7

   Step 7

   Store it offline and practise it

   Print the plan and keep a copy outside your normal systems. Walk through a scenario once a year.