If your email is hacked or your files are locked, who does your team call first? Fill in this plan now so they don't have to guess.
A plan your team can use under pressure
Built for businesses with about 5-50 employees, this fillable PDF helps your owner, staff, and IT provider agree on what to do when something goes wrong.
Add your contacts, systems, and recovery priorities. Review it with your IT provider, insurance broker, and attorney.
What's in the 18-page PDF?
- Emergency contacts and a first-hour checklist.
- Playbooks for hacked email, payment fraud, ransomware, and data theft.
- Industry add-ons for trucking, manufacturing, agriculture, and accounting/tax.
- Team roles, insurance questions, and system and vendor contacts.
- A 15-minute practice exercise on page 12.
- Incident records, notification worksheets, message templates, and recovery checks.
Adapt the plan to your business
A stopped production line needs a different response from stolen tax records. Use the industry add-ons to cover your equipment, accounts, and reporting duties.
Tax preparers should connect this plan to their Written Information Security Plan. Ask your attorney to check notification requirements.
Fill it in, then practice
Use a PDF reader that supports fillable fields and check that your entries save. Keep the completed plan secure. Don't put passwords in it.
Print the contact card. Keep a protected copy of the plan somewhere you can reach without business email.
Try the page 12 exercise with your team and IT provider. Decide who calls the bank, contacts the insurer, and keeps work moving.
Awareness training helps staff spot and report suspicious requests. Practicing the plan helps your team respond. They serve different purposes.
Questions about the free template
Do I have to sign up for marketing emails?
No. The PDF is free either way. Occasional emails are optional and require confirmation. Leaving the box unchecked keeps any existing preference unchanged.
Can I use Gmail or another personal address?
Use your business email. Known personal and temporary addresses are blocked. Your own domain on Google Workspace or Microsoft 365 is fine.
Does this meet insurance or legal requirements?
Not by itself. This is a planning tool, not legal advice or an emergency response service. Your broker and attorney should check it against your policy and obligations.
Useful guides for your next practice session
Get your free small business incident response plan
Check what attackers can see
The plan helps you prepare for an incident. Our free exposure review shows what is already visible about your business online.