A ten-person company has no security team, so the first hour of an incident depends on a plan written in advance. The stakes are real: Verizon's 2025 DBIR found ransomware in 44% of breaches, and India's CERT-In requires specified incidents to be reported within 6 hours. This guide turns NIST's 2025 incident response guidance into a plan small enough to use.
What changed in NIST's incident response guidance
In April 2025 NIST published SP 800-61 Revision 3, replacing the 2012 Computer Security Incident Handling Guide. The new version is a CSF 2.0 Community Profile: rather than treating incident response as a separate phase, NIST says it is a critical part of cybersecurity risk management and should be integrated across operations, with roles across all six CSF 2.0 functions. For a small company, the practical message is that response starts before the incident. Knowing your assets, keeping backups and logs, and agreeing who decides what are all part of the plan.
Roles for a ten-person team
Small teams fail when everyone helps and nobody decides. Assign named people, with a backup for each, and put their phone numbers in the plan. Keep a printed or offline copy, because the systems you normally use to coordinate, such as email or chat, may be the ones affected.
| Role | Typical owner | Responsibilities |
|---|---|---|
| Incident lead | CTO or senior engineer | Declares the incident, sets severity, makes technical calls |
| Business lead | CEO or founder | Customer, legal and regulator decisions, approves spend |
| Communications | Whoever handles customers | Drafts customer and staff messages from approved facts |
| Scribe | Any team member | Keeps a timestamped log of actions and decisions |
| External help | Pre-agreed vendor, lawyer, insurer | Forensics, legal advice, cover conditions |
Severity levels that trigger action
Define three levels so nobody debates in the moment. Severity 1: confirmed access to customer data, ransomware, or loss of production; wake everyone and start the reporting clock. Severity 2: a suspected compromise such as a leaked key or a phishing click with credential entry; respond the same day. Severity 3: suspicious activity with no confirmed impact; log and review. Write down who can declare each level and agree that it is fine to declare high and downgrade later. Delay is usually more costly than a false alarm.
The first hour: contain without destroying evidence
The first hour decides how bad an incident becomes. These steps fit most cloud-based small businesses. The aim is to stop the damage spreading while keeping the evidence you will need for root cause analysis, insurance claims and any report to CERT-In. Note the time of each action in the incident log as you go.
- Start the incident log and note the time you became aware
- Revoke or rotate exposed credentials and keys, as OWASP advises for leaked secrets
- Isolate affected machines or accounts rather than wiping them
- Preserve logs and take snapshots before making big changes
- Check whether backups are intact and offline
- Decide early whether this is reportable and who will report it
Reporting duties in India
CERT-In's Directions of April 2022 require covered entities to report specified incidents within 6 hours of noticing them or being told about them. The listed categories include data breaches, data leaks, targeted scanning of critical systems, phishing, compromise of systems, unauthorised access and website defacement. CERT-In's FAQs allow an initial report with the facts available, with more detail later.
Non-compliance can bring up to one year's imprisonment, a fine of up to ₹1,00,000, or both under Section 70B. Logs kept for the required 180 days will be requested, so keep them reachable. Check sector regulators and customer contracts for further notice duties.
Ransomware and extortion: decide in advance
Verizon's 2025 DBIR found ransomware present in 44% of breaches and a median payment of USD 115,000. IBM's 2025 study found 63% of organisations chose not to pay a ransom. Decide your position, your insurer's role and who may talk to an extortionist before it happens, not during. The best defence is recovery you have tested: backups that ransomware cannot reach, a documented restore order for critical systems, and a recent restore drill that shows how long it takes.
Practise with a tabletop exercise
A plan nobody has rehearsed is a guess. CISA publishes more than 100 tabletop exercise packages with scenarios, discussion questions, facilitator material and after-action report templates, including ransomware, insider threat and phishing scenarios. A small team can adapt one in an afternoon. Run a short session twice a year. Walk through a scenario, note where people were unsure, and update the plan the same week. Rotate the incident lead role so knowledge is not held by one person.
After the incident
Hold a blameless review within two weeks: what happened, how it was found, what slowed the response and what will change. NIST's guidance treats these lessons as input to risk management, so turn each finding into a tracked task with an owner. XDQ Labs helps small teams write and test incident response plans and fixes the root causes it finds, working only on systems the client is authorised to test.
Frequently asked questions
What should a small business incident response plan include?
Named roles with backups and phone numbers, clear severity levels, first-hour containment steps, reporting duties (such as CERT-In's 6-hour rule in India), contacts for external help, a communication approach and a review step. One or two pages that people actually read beats a long document nobody opens.
What is NIST SP 800-61 Rev. 3?
It is NIST's incident response guidance, finalised on 3 April 2025. It replaces the 2012 Revision 2 and frames incident response as part of cybersecurity risk management using the six functions of NIST CSF 2.0.
Do Indian startups have to report cyber incidents to CERT-In?
Under CERT-In's April 2022 Directions, covered entities must report specified incidents, such as data breaches, unauthorised access and website defacement, within 6 hours of becoming aware of them. An initial report can be followed by more detail later. Take legal advice on how the rules apply to you.
How often should a small company test its incident response plan?
Running a tabletop exercise at least twice a year, and after major changes to systems or staff, is a sensible rhythm. CISA's tabletop exercise packages provide ready-made ransomware, phishing and insider scenarios that a small team can adapt.
Sources
- NIST Revises SP 800-61: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, NIST, 2025
- SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, NIST CSRC, 2025
- An Overview On The CERT-In Cyber Security Directions, 2022, Mondaq, 2022
- CERT-In releases FAQs explaining the Direction on cybersecurity, Nishith Desai Associates, 2022
- Verizon 2025 Data Breach Investigations Report: news release, Verizon, 2025
- Average global data breach cost now $4.44 million (IBM Cost of a Data Breach Report 2025), Help Net Security, 2025
- CISA Tabletop Exercise Packages, CISA, 2026
- Secrets Management Cheat Sheet, OWASP Cheat Sheet Series, 2025
