Incident plan for a small team: the first hour

In one minute

An incident plan for a small team fits on one page: five jobs, one named person on each, and the phone numbers and accounts you will need.
The first hour has five steps: notice, contain, tell, recover and record. They follow the public guides from NIST in the United States and the National Cyber Security Centre in the United Kingdom.
Contain without destroying evidence. Take the Mac off the network, change the account password from another device, and do not wipe anything yet.
Look up who must hear about it before the day you need to know. Clients and insurers have their own terms. If personal data is at risk, EU law asks for a report within 72 hours where feasible, and Swiss law asks for one as soon as possible when the risk is high.
Check the contact list every couple of months and walk through the page once a year.

On this page

What goes into an incident plan for a small team?

One page. It names five jobs, puts one person on each, and lists the numbers and accounts you need when nothing else is working. The jobs are notice, contain, tell, recover and record.

Large companies write binders. A team of five needs something that somebody can find on a Tuesday evening, with a ransom message on a screen and email not to be trusted. So the plan has to be short, and everyone has to know where it is kept.

What counts as an incident?

What an incident is.

Something that puts your data, your accounts or your Macs at risk. A ransom message on a screen, an email account sending links nobody wrote, a laptop left on a train, a former freelancer who still has access.

Some of these turn out to be nothing. Deciding which is the first job of the plan, and one person should make that call.

A work Mac is missing

Five steps, one name each.

Two public guides agree on the shape. NIST, the United States standards body, published its guide to handling incidents as Special Publication 800 61, revision 3, in April 2025. It sorts the work into detecting, responding and recovering, and feeds what you learn back into the plan. The UK National Cyber Security Centre (NCSC) writes five steps for small businesses: prepare, identify what is happening, resolve, report to wider stakeholders and learn.

The five steps below are our plain version of both, laid over one hour. Say a studio of five people. Everybody has a name on the page, and nobody has to ask who is in charge.

the first hourfive steps, five names

1
Notice.
Anyone who sees a warning sign phones Ana. Ana decides whether it is an incident, says so out loud and starts the shared page.
Ana calls it · minutes 0 to 10
2
Contain.
Luca takes the affected Mac off the network and signs the affected account out everywhere, from a different device. Nothing is wiped.
Luca holds the Macs and accounts · minutes 10 to 30
3
Tell.
Mira sends every message that leaves the studio: clients, the insurer and, if the page says so, an authority. Facts only, and when the next update comes.
Mira speaks for the studio · minutes 30 to 45
4
Recover.
Noah restores from a backup he has tested, replaces passwords and keys, and reconnects a Mac only when someone has looked at it.
Noah restores · from minute 45
5
Record.
Elif writes down every time, action and decision on the shared page, from minute 0, and keeps the same page after the hour is over.
Elif keeps the page · the whole time

A fictional studio of five. The minutes are a rough pace for a first hour, not a rule from the sources.

Notice first. The NCSC lists warning signs a small business can see: computers that respond slowly, accounts people cannot log in to, documents that will not open, a ransom demand, strange emails sent from your own domain, unexpected payment requests and account activity that looks wrong. Tell Ana by phone. If the email account is the one that was taken over, an email to Ana may be read by the person who took it.

Decide the names while you are calm.

Then contain. For a Mac, disconnect it from the network. Do not wipe it or reinstall macOS yet, because what is on it tells you what happened. For an account, work from a different, trusted device: change the password, sign out every open session, and look for rules that forward mail and for apps that were given access.

Keys need a thought of their own. Any key or token that lived on the Mac may have to be replaced, at the service that issued it. Who still has your client’s API keys? walks through that.

Know who must hear, and by when.

Telling people is the step small teams skip, and the one with deadlines. Look them up before the day you need them and write them on the page. What follows is general information, checked on 28.10.2026, and not legal advice. The rules in your country may differ.

Clients come first. A contract or a client’s security questionnaire may say how fast you must report. Your insurer is next. The NCSC guide asks you to keep the insurer’s contact details, your policy number and any rules the policy sets for how you respond inside the plan itself.

Then the law, where it applies. In the European Union, Article 33 of the General Data Protection Regulation (GDPR) covers personal data that was lost, altered, disclosed or reached without permission. The organisation responsible must tell the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. It does not have to if the incident is unlikely to put people at risk, and a later notice needs a reason for the delay. The European Data Protection Board reads “aware” as having a reasonable degree of certainty that an incident has put personal data at risk. Whether or not you report, you keep a written record of every such incident.

If you handle data for a client, you are usually the one the regulation calls the processor. Your duty then is to tell the client without undue delay, under Article 33(2). The client decides about the authority.

Switzerland has its own rule. Article 24 of the Federal Act on Data Protection asks the controller to report to the Federal Data Protection and Information Commissioner as soon as possible when an incident is likely to bring a high risk to the people concerned. The Commissioner’s guidance, version 1.2 of 23 April 2025, says a ransomware case starts from an assumed high risk, and the report does not wait for a long investigation. Details can follow.

A third rule is narrower. Since 1 April 2025, operators of critical infrastructure in Switzerland, such as energy and drinking water suppliers, transport companies and cantonal and communal administrations, must report a cyberattack to the National Cyber Security Centre within 24 hours of discovering it. It applies to those operators only. Most small teams are outside it, though a client of yours may be inside it and may ask you to tell them quickly.

On the page, write the authority’s reporting address and the deadline. Ana, or a lawyer, decides whether an incident is reportable. The plan only makes sure that decision is taken in time.

Controller or processor?

Controller and processor.

The controller decides why and how personal data is used. The processor handles it on the controller’s behalf. A client who gives your agency a customer list is the controller. You, working on that list, are the processor.

If your own staff, customers or leads are involved, you may be the controller as well. Your data protection adviser can tell you which you are, for which data.

Put the plan on one page.

Write it as a page with blanks and fill it in once. Keep one copy where a locked laptop cannot stop you, printed or on a phone, and a second in a place that does not depend on the accounts that might be taken over. The NCSC says the same about the contact list: store it where you can reach it if normal communication fails.

Copy these eight lines into a document of your own.

the one page planeight lines to fill in

Who to call, in order.The five names, their phone numbers and who covers when someone is away.
Where the admin accounts are.Email, domain, cloud storage, code hosting, the bank. Who holds each recovery code.
The client contacts.One named person per client, and what each contract says about telling them.
The insurer’s number.The policy number, and what the policy asks you to do before you hire any help.
Outside help.Whoever looks after your IT, your host or your domain, with the contract number.
The backups.Where they are, who can restore them, and the date of the last test restore.
The authority and the deadline.The reporting address that applies to you, and who decides whether to use it.
Where the record goes.One shared page that does not depend on the affected accounts. Elif opens it at minute 0.

The whole plan. Eight lines, one page, filled in before the day you need it.

Check the numbers every couple of months, which is the NCSC’s own rhythm. Once a year, sit down for half an hour with the page and an invented case, such as Mira’s email account sending links nobody wrote. Talk through each step aloud and see which line stays blank. For a longer exercise the NCSC points small teams to its Exercise in a Box.

Where Cybee fits in that hour.

Cybee runs on the Macs your team works on. It does not run your incident, but it helps at the start and at the end.

At the start, real time protection acts on the Mac first. It looks for known malware and for behaviour that has no signature yet, such as a program collecting passwords or switching protections off. It quarantines the program, stops it or puts the setting back, and then tells you.

The alert then reaches the person on your page. Alerts arrive in the chat with your AI assistant, as macOS notifications, in Slack, and on a phone by WhatsApp or SMS. All of that is free. A phone number is verified with a six digit code and gets the critical and high alerts by default. In the studio’s plan, that phone is Ana’s.

At the end, an insurer or a client will ask which Macs were protected, and since when. Cybee keeps a dated record of every control. The Trust Passport is a dated record of how your Macs are protected, shared by one link. A fingerprint at its foot shows the page has not changed since Cybee sealed it. It does not check the facts a second time. It belongs to the Cybee subscription, which has a 14 day trial.

What to remember.

Put one name on each of the five jobs, and give the first call to a phone, not to email.
Disconnect and sign out. Wipe nothing until you know what happened.
Look up the deadlines for your clients and your insurer now, and the authority’s too. Write them on the page.
Test a restore, and read the page aloud once a year.

Sources and product scope.

Written by Cybee for small teams. Outside pages checked on 28.10.2026. This is general information and not legal advice. The product facts are in our documentation.

See how an alert reaches your team.

One clear alert, what Cybee did on the Mac first, and the decision that stays with you.

Work through an alert

A plan for the first hour. Who does what when a Mac or an account is taken over.