Cyber Incident Response Plan for Small Businesses: An Australian Checklist
$56,600. That’s the average hit an Australian small business reported for a single cybercrime, up 14% in just twelve months, according to the ASD Annual Cyber Threat Report 2024–25. ASD logged more than 84,700 of these reports over the year, roughly one every six minutes.
For a local café or a two-person bookkeeping practice, that’s not a bad month. That’s the year.
After years of writing about this stuff, one pattern keeps showing up. The owners who come through an attack in decent shape usually aren’t the ones with fancy security tools.
They’re the ones who sat down one quiet afternoon and wrote out who does what if it all goes sideways. That bit of paper is a cyber incident response plan, and this post shows small business owners how to put one together, with a checklist shaped around Australian law.
MSPs and agencies stick around. There’s a part near the end written for you.
So what is a cyber incident response plan for a small business, exactly?
That little evacuation map stuck by the lunchroom fridge is a decent comparison, only this version covers laptops, logins and bank accounts. Who’s boss for the day?
The phone numbers, plus the order you dial them. The stuff your hands actually do in hour one, so a rotten Tuesday stays a rotten Tuesday and not a lost month.
Writing it down matters because people panic. It’s common for a stressed owner to reboot an infected laptop, wiping the very evidence the insurer will ask for later. Others reply to the scammer from the same hacked inbox, and the attacker reads every word.
Print it. Seriously. If ransomware has locked your server, a PDF sitting on that server won’t help anyone. Agree on a fallback channel too, say a WhatsApp group on personal phones, because work email might be the thing that’s been taken over.
What are the cyber incident reporting rules in Australia?
Fixing the tech is only half the job here. Some incidents come with a legal stopwatch attached, and blowing a deadline can end up costing more than the hack itself.
Notifiable Data Breaches (NDB) scheme
It lives in the Privacy Act 1988. If personal information leaks and someone could be seriously harmed, you have to tell the OAIC and the people affected.
If you only suspect a breach, the law gives you up to 30 days to look into it, though the OAIC would much rather you move faster.
Plenty of businesses turning over less than $3 million a year are exempt. Plenty, not all. Health providers are caught regardless of size, so is anyone who trades in personal information, and the exemption has been shrinking with each round of reform. Check where you stand instead of guessing.
Ransomware payment reporting
Turnover north of $3 million means one extra rule. From 30 May 2025, if a ransom gets paid, by you or by anyone acting for you, the Australian Signals Directorate (ASD) has to hear about it within 72 hours. Late reports can attract a civil penalty, so put someone’s name against this job in your plan.
Voluntary reporting
Under the threshold, you can still report through ReportCyber, and it’s worth doing. It costs nothing, and every report helps ASD warn the next business in line.
Who should a small business call after a cyber attack?
Pop these into your phone today, and stick a printed copy on the office wall while you’re at it.
| Who | When to contact them | How |
|---|---|---|
| ASD's Australian Cyber Security Hotline | Any active cyber incident, 24/7 | Ring 1300 CYBER1 (1300 292 371), or lodge it online through ReportCyber |
| Small Business Cyber Resilience Service, run by IDCARE | Free one-on-one help to recover or prepare | 1800 595 170, Mon–Fri, 8am–6pm AEST |
| Your bank | Money sent to a scammer or odd transactions | Bank's fraud line, straight away |
| Your cyber insurer | Before paying anyone or hiring specialists | The incident hotline in your policy |
| OAIC | A notifiable data breach | Online NDB form |
What should a cyber incident response checklist include?
I’ve split this cyber incident response checklist into four stages. Stage one is homework you do now, on a calm day. The rest you’ll follow when things are anything but calm.
1. Sort it while things are quiet
- Name someone to run the show if things go bad, plus a backup for when they’re on leave. Both need the green light to spend money or yank systems offline, no meeting required.
- Add your IT provider and accountant to the contact list above.
- Write down your critical systems, such as email, accounting software, POS and cloud storage, and note who holds each admin login. In plenty of small offices, that last bit turns out to be a mystery.
- Switch MFA on for every account that’ll let you, starting with email and the bank.
- Keep one backup offline and actually test a restore each quarter. A backup you’ve never restored is a hope, not a plan.
- Go through ASD’s free Cyber Incident Readiness Checklist.
2. Contain it (the first hour)
- Pull the network cable or switch off Wi-Fi on anything affected. Don’t shut it down, though. Leave it running so the evidence survives.
- Grab your phone and photograph the ransom note or whatever odd screen you’re looking at. Start a running log with times.
- Ring your IT provider or service desk / help desk first, then your insurer. If money’s already gone out, get the bank on the line immediately, because every hour counts when they’re trying to claw a payment back.
- Don’t pay any ransom yet. The government advises against it, and your insurer and lawyer need a say before anyone transfers a cent.
3. Investigate and secure
- From a clean device, reset passwords, email and admin accounts before anything else, and kick out every logged-in session.
- Hunt for sneaky mailbox rules. Attackers love setting one up that quietly forwards or deletes your mail.
- Figure out which data was touched. If personal information is in the mix, your NDB assessment clock starts today.
4. Communicate and recover
- Hand staff a short script so every customer hears the same honest story.
- If your email was hijacked, warn clients now, before someone pays a fake invoice with your logo on it.
- Restore from backups you know are clean, and not before.
- Get any OAIC notice or ransomware report in before its deadline runs out.
- Within a fortnight, sit down, work out what went wrong, fix the plan and retrain.
What goes into an incident response plan template in Australia?
No need to start with a blank page. ASD and business.gov.au both put out free material for small businesses. Whichever incident response plan template you end up using in Australia, make sure it has room for the following.
| Section | What to write |
|---|---|
| Purpose and scope | Which systems and data the plan covers |
| Roles and contacts | Incident lead, deputy and the help lines above |
| Incident types | Ransomware, email compromise, invoice fraud, lost device, data breach |
| Response steps | The checklist above, tailored to your systems |
| Legal duties | NDB assessment (30 days); ransomware report (72 hours, if over $3M turnover) |
| Communications | Draft messages for staff and customers |
| Recovery | Backup locations and restore order |
| Review | Last test date, next review date, plan owner |
Short wins here. Honestly, three pages every staff member has skimmed over a cuppa will beat a 40-page binder propping up somebody’s monitor. If you can’t face writing it, hand it off. Decent cyber security consulting starts from the kit you’ve actually got and works out what’d hurt most to lose.
MSPs and agencies: how do you help a client who’s just been hacked?
The client’s insurer is rarely the first to know. You are, often via a frantic 7am call from someone who hasn’t had a coffee yet. Do a little homework now and that call goes from flat panic to ticking boxes.
- Stash each client’s plan, admin contacts and backup info on your side too. If their systems are down, yours probably aren’t.
- Put the split of jobs in writing: who contains the damage, who keeps evidence, who fronts up to the client’s customers, who handles the regulator.
- Put your remote access tools behind MFA. Break into one MSP and you’re potentially inside forty businesses. The crooks figured that out ages ago.
- Sort out after-hours cover, since attackers don’t keep office hours.
Once a year, run a tabletop exercise with your biggest clients. It’s the quickest way to spot where your plan and theirs don’t quite line up.
How can small businesses improve cyber security preparedness?
The plan is your safety net. Good habits mean you hopefully never land in it. Here are a few that lift your cyber security preparedness without costing a fortune.
- Rehearse once a year. An hour around the table with a realistic scenario, like a supplier emailing new bank details, will show you the gaps fast.
- Get staff trained. Cyber Wardens, a government-funded program, runs free, bite-sized online courses for small business teams.
- Confirm any change to payment details by phone, on a number you already had. Never the one in the email.
- Let updates install automatically, and keep admin rights to the handful of people who genuinely need them.
- Have someone watching out of hours. Plenty of attacks kick off on a Friday night, and 24/7 NOC SOC monitoring can catch them long before Monday’s coffee.
- Work towards ASD’s Essential Eight. More and more insurers quiz you on it when the policy comes up for renewal.
Start your plan this week
Your cyber incident response plan doesn’t have to be polished, even for a small business starting from zero. Choose your incident lead this week. Print that contact table.
Test one backup. Then spend half an hour talking the team through the checklist, and you’ll be in a far better spot than you were on Monday.
If you’d like a second pair of eyes on it, SupportHub360’s Perth team works with Australian businesses and the providers behind them, from writing the plan right through to responding on the day.
Feel free to contact SupportHub360 and we’ll help you get it sorted.
