# A plan for the first hour. Who does what when a Mac or an account is taken over. > A one page incident plan for a small team on Macs: five steps for the first hour, one name on each, who to tell and a template to copy. Page: https://cybee.ai/blog/incident-plan-small-team/ (Incident plan for a small team: the first hour) - [Blog](https://cybee.ai/blog/) - Incident plan your team A colleague’s email starts sending links nobody wrote, and everyone looks at everyone else. Decide now who calls it, who contains it, who tells your clients and who writes it all down. A plan that fits on one page is a plan people use. By [Cybee](https://cybee.ai/about/#founders) Published 28.10.2026 10 minute read In one minute - An incident plan for a small team fits on one page: five jobs, one named person on each, and the phone numbers and accounts you will need. - The first hour has five steps: notice, contain, tell, recover and record. They follow the public guides from NIST in the United States and the National Cyber Security Centre in the United Kingdom. - Contain without destroying evidence. Take the Mac off the network, change the account password from another device, and do not wipe anything yet. - Look up who must hear about it before the day you need to know. Clients and insurers have their own terms. If personal data is at risk, EU law asks for a report within 72 hours where feasible, and Swiss law asks for one as soon as possible when the risk is high. - Check the contact list every couple of months and walk through the page once a year. ## What goes into an incident plan for a small team? One page. It names five jobs, puts one person on each, and lists the numbers and accounts you need when nothing else is working. The jobs are notice, contain, tell, recover and record. Large companies write binders. A team of five needs something that somebody can find on a Tuesday evening, with a ransom message on a screen and email not to be trusted. So the plan has to be short, and everyone has to know where it is kept. **Q:** What counts as an incident? ### What an incident is. Something that puts your data, your accounts or your Macs at risk. A ransom message on a screen, an email account sending links nobody wrote, a laptop left on a train, a former freelancer who still has access. Some of these turn out to be nothing. Deciding which is the first job of the plan, and one person should make that call. [A work Mac is missing](https://cybee.ai/blog/lost-work-mac/) ## Five steps, one name each. Two public guides agree on the shape. NIST, the United States standards body, published its guide to handling incidents as Special Publication 800 61, revision 3, in April 2025. It sorts the work into detecting, responding and recovering, and feeds what you learn back into the plan. The UK National Cyber Security Centre (NCSC) writes five steps for small businesses: prepare, identify what is happening, resolve, report to wider stakeholders and learn. The five steps below are our plain version of both, laid over one hour. Say a studio of five people. Everybody has a name on the page, and nobody has to ask who is in charge. 1 2 3 4 5 Figure: A fictional studio of five. The minutes are a rough pace for a first hour, not a rule from the sources. Notice first. The NCSC lists warning signs a small business can see: computers that respond slowly, accounts people cannot log in to, documents that will not open, a ransom demand, strange emails sent from your own domain, unexpected payment requests and account activity that looks wrong. Tell Ana by phone. If the email account is the one that was taken over, an email to Ana may be read by the person who took it. > Decide the names while you are calm. Then contain. For a Mac, disconnect it from the network. Do not wipe it or reinstall macOS yet, because what is on it tells you what happened. For an account, work from a different, trusted device: change the password, sign out every open session, and look for rules that forward mail and for apps that were given access. Keys need a thought of their own. Any key or token that lived on the Mac may have to be replaced, at the service that issued it. [Who still has your client’s API keys?](https://cybee.ai/blog/client-api-key-handover/) walks through that. ## Know who must hear, and by when. Telling people is the step small teams skip, and the one with deadlines. Look them up before the day you need them and write them on the page. What follows is general information, checked on 28.10.2026, and not legal advice. The rules in your country may differ. Clients come first. A contract or a client’s security questionnaire may say how fast you must report. Your insurer is next. The NCSC guide asks you to keep the insurer’s contact details, your policy number and any rules the policy sets for how you respond inside the plan itself. Then the law, where it applies. In the European Union, Article 33 of the General Data Protection Regulation (GDPR) covers personal data that was lost, altered, disclosed or reached without permission. The organisation responsible must tell the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. It does not have to if the incident is unlikely to put people at risk, and a later notice needs a reason for the delay. The European Data Protection Board reads “aware” as having a reasonable degree of certainty that an incident has put personal data at risk. Whether or not you report, you keep a written record of every such incident. If you handle data for a client, you are usually the one the regulation calls the processor. Your duty then is to tell the client without undue delay, under Article 33(2). The client decides about the authority. Switzerland has its own rule. Article 24 of the Federal Act on Data Protection asks the controller to report to the Federal Data Protection and Information Commissioner as soon as possible when an incident is likely to bring a high risk to the people concerned. The Commissioner’s guidance, version 1.2 of 23 April 2025, says a ransomware case starts from an assumed high risk, and the report does not wait for a long investigation. Details can follow. A third rule is narrower. Since 1 April 2025, operators of critical infrastructure in Switzerland, such as energy and drinking water suppliers, transport companies and cantonal and communal administrations, must report a cyberattack to the National Cyber Security Centre within 24 hours of discovering it. It applies to those operators only. Most small teams are outside it, though a client of yours may be inside it and may ask you to tell them quickly. On the page, write the authority’s reporting address and the deadline. Ana, or a lawyer, decides whether an incident is reportable. The plan only makes sure that decision is taken in time. **Q:** Controller or processor? ### Controller and processor. The controller decides why and how personal data is used. The processor handles it on the controller’s behalf. A client who gives your agency a customer list is the controller. You, working on that list, are the processor. If your own staff, customers or leads are involved, you may be the controller as well. Your data protection adviser can tell you which you are, for which data. ## Put the plan on one page. Write it as a page with blanks and fill it in once. Keep one copy where a locked laptop cannot stop you, printed or on a phone, and a second in a place that does not depend on the accounts that might be taken over. The NCSC says the same about the contact list: store it where you can reach it if normal communication fails. Copy these eight lines into a document of your own. Figure: The whole plan. Eight lines, one page, filled in before the day you need it. Check the numbers every couple of months, which is the NCSC’s own rhythm. Once a year, sit down for half an hour with the page and an invented case, such as Mira’s email account sending links nobody wrote. Talk through each step aloud and see which line stays blank. For a longer exercise the NCSC points small teams to its Exercise in a Box. ## Where Cybee fits in that hour. Cybee runs on the Macs your team works on. It does not run your incident, but it helps at the start and at the end. At the start, real time protection acts on the Mac first. It looks for known malware and for behaviour that has no signature yet, such as a program collecting passwords or switching protections off. It quarantines the program, stops it or puts the setting back, and then tells you. The alert then reaches the person on your page. Alerts arrive in the chat with your AI assistant, as macOS notifications, in Slack, and on a phone by WhatsApp or SMS. All of that is free. A phone number is verified with a six digit code and gets the critical and high alerts by default. In the studio’s plan, that phone is Ana’s. At the end, an insurer or a client will ask which Macs were protected, and since when. Cybee keeps a dated record of every control. The Trust Passport is a dated record of how your Macs are protected, shared by one link. A fingerprint at its foot shows the page has not changed since Cybee sealed it. It does not check the facts a second time. It belongs to the Cybee subscription, which has a 14 day trial. What Cybee does not do Cybee is not a managed security service, and it does not run your incident for you. It does not call your clients, your insurer or an authority. It does not check your email or cloud accounts, and the Trust Passport does not describe what happened in your incident. ## What to remember. - Put one name on each of the five jobs, and give the first call to a phone, not to email. - Disconnect and sign out. Wipe nothing until you know what happened. - Look up the deadlines for your clients and your insurer now, and the authority’s too. Write them on the page. - Test a restore, and read the page aloud once a year. ## Sources and product scope. Written by Cybee for small teams. Outside pages checked on 28.10.2026. This is general information and not legal advice. The product facts are in our documentation. - [NIST: Special Publication 800 61 revision 3, recommendations for handling incidents (April 2025)](https://csrc.nist.gov/pubs/sp/800/61/r3/final) - [NCSC (United Kingdom): Small Business Guide, Response and Recovery](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery) - [European Data Protection Board: Guidelines 9/2022, notification under the GDPR, version 2.0](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en) - [Federal Data Protection and Information Commissioner (Switzerland): guidelines on Article 24 of the Federal Act on Data Protection, version 1.2](https://www.edoeb.admin.ch/en/guidelines-data-breach) - [National Cyber Security Centre (Switzerland): reporting cyberattacks on critical infrastructure from 1 April 2025](https://www.bacs.admin.ch/25-mp-en) - [Cybee: Trust Passport](https://cybee.ai/docs/trust-passport/) ## See how an alert reaches your team. One clear alert, what Cybee did on the Mac first, and the decision that stays with you. [Work through an alert](https://cybee.ai/use-cases/security-alerts/) On this page - The short answer - Five steps, one name each - Know who must hear, and by when - Put the plan on one page - Where Cybee fits - What to remember - Sources Cybee Acts on the Mac first, then alerts you in the chat, in Slack, as a notification or by WhatsApp or SMS. Free on every Mac. [See how it works](https://cybee.ai/product/) ## The next question someone asks. Three more guides. [Mac security A work Mac is missing. What should you do first? Report it, check the controls you have, review account access and keep the useful records. Read the guide](https://cybee.ai/blog/lost-work-mac/) [client requests What evidence should you prepare for cyber insurance? What an insurer asks about your Macs, and what to have ready before the renewal. Read the guide](https://cybee.ai/blog/cyber-insurance-evidence/) [your team Who still has your client’s API keys? Keys in scripts, automations or AI tools at a handover: what to keep, what to replace and what to remove. Read the guide](https://cybee.ai/blog/client-api-key-handover/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. What the command does - Installs a notarized agent on this Mac. - Creates no account. The install is identified by a token. - Starts protecting the device at once. - Changes no setting until you confirm it in your AI assistant. - Asks for this Mac’s administrator password once, and for no email address. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)