Incident response team for small businesses: who does what when you're hacked?
Last updated on
In the first hours of a cyber attack, things often go wrong on something simple. Nobody knows who decides. The IT partner switches off a server and the evidence is gone. A colleague posts on LinkedIn before customers have been told. An incident response team prevents that. The Dutch NCSC advises every organisation to set up such a team with fixed roles, even a small one (NCSC, in Dutch (opens in new tab)).
What is an incident response team?
It is the group of people who take over when there is a security incident, such as ransomware, a hacked email account or a data breach. In a large company they are specialists. In a small business they are simply the director, someone who knows the IT, someone for communication and your outside IT partner. More important than expertise is that everyone knows their role beforehand.
Who declares the incident?
Someone has to say out loud: this is an incident, the team takes over. According to the NCSC this is usually someone from the board or management team (NCSC, in Dutch (opens in new tab)). Also agree when you do this. For example on a ransomware screen, a suspicious login on an admin account or when customer data is exposed.
The roles in the team
Lead: makes decisions and keeps the overview.
IT: takes affected systems off the network and keeps evidence. Switches nothing off and wipes nothing.
Communication: informs colleagues, customers, suppliers and the press if needed.
Legal and privacy: looks at the reporting duty and contracts.
HR: when an employee is involved.
Log keeper: writes everything down with the time. You need it for the review and for the regulator (NCSC, in Dutch (opens in new tab)).
Only a few people? Combine roles, but give every role a backup. An incident always happens the week someone is on holiday.
Arrange outside help beforehand
The NCSC mainly helps you find out what is going on. For cleaning up and recovery it advises calling in a specialist incident response firm early, and knowing beforehand which one (NCSC, in Dutch (opens in new tab)). Also check your cyber insurance. Many policies come with a fixed firm you can call around the clock.
Reporting duty: the clock is ticking
If personal data leaks and there is a risk to the people it belongs to, you report it to the Dutch Data Protection Authority within 72 hours (AP, in Dutch (opens in new tab)). If your business falls under the Dutch Cybersecurity Act, you send an early warning to the NCSC within 24 hours (NCSC, in Dutch (opens in new tab)). Give someone on the team the job of watching these deadlines.
Communication: write the texts now
During a crisis there is no time to write a good email to customers. Prepare texts now for staff, customers, suppliers and the press, and agree who says what and when. Our crisis communication plan has ready-made texts you only need to complete.
Practise once a year
A plan on paper always works differently in practice. The NCSC calls a yearly exercise an absolute must (NCSC, in Dutch (opens in new tab)). A tabletop exercise is enough: get the team together for an hour and walk through a scenario, such as ‘we have ransomware’. You will see right away who is missing and which number is wrong.
The team, the emergency plan and the continuity plan
The incident response team is one part. The emergency plan says what to do in the first hour. The business continuity plan says how you keep working in the days after, also when the office or a supplier fails (NCSC, in Dutch (opens in new tab)).
Download and print the cyber attack emergency plan
A checklist of a few pages that you fill in once and then print. With the first steps, a list of contacts and the reporting deadlines.
Go to the cyber attack emergency planStart today
Open the incident response team checklist, fill in the names and numbers and print it for everyone on the team. Then take the free IT check to see where else you have gaps, or read the cybersecurity checklist.
Sources
Dutch NCSC: incident response, where do I start? (in Dutch) (opens in new tab)
Dutch NCSC: incident response plan (in Dutch) (opens in new tab)
Dutch NCSC: help and support with cyber incidents (in Dutch) (opens in new tab)
Dutch NCSC: how to make a business continuity plan (in Dutch) (opens in new tab)
Dutch NCSC: reporting under the Cybersecurity Act (in Dutch) (opens in new tab)
Dutch Data Protection Authority: data breach notification (in Dutch) (opens in new tab)
Read more
- Node2Shell: the Node.js flaw, which version you need and what to do
On the same day as the PHP flaws, Node.js shipped a fix for ten vulnerabilities. The worst, Node2Shell, lets an attacker run code through compressed data. Which versions are safe, when they came out and what to do now.
- PHP2Shell: why DigiD went offline and what to do with your website
On 21 October 2026 dozens of Dutch and Belgian sites, including DigiD and the Dutch parliament, went offline over two critical PHP flaws. What happened, why updating WordPress does not help and what a small business should do with its website now.
- Cyber attack at Albert Heijn: what can a small business learn?
Albert Heijn could not deliver for almost two weeks, M&S stopped selling online for six weeks and a Dutch lab leaked data on hundreds of thousands of women. What a small business can learn from it, and what to do in the first hours.