You're reading The SME Security Brief, practical IT, cyber security and technology advice for Irish and UK businesses. No jargon. No scare tactics. Just what you need to know, every week.
If someone forwarded this to you, you can subscribe at thesmesecuritybrief.com.
THIS WEEK'S THREAT 🔴
Most businesses find out they have no incident response plan at the worst possible moment.
Picture it. It is 6pm on a Friday. Someone calls you to say their computer is showing a strange message. Files are locked. A ransom demand is on the screen. Your systems are down. Your accountant cannot open the accounts. Your CRM is inaccessible. Nobody can process orders.
What do you do first?
If your answer is anything other than a clear, immediate sequence of steps, you do not have an incident response plan. And you are not alone. The vast majority of small businesses have never written one down, never discussed what would happen, and have no idea who to call beyond their IT provider, assuming they can even reach them on a Friday evening.
The problem is not that small business owners are careless. It is that incidents feel like a distant possibility until they happen, and by then it is too late to think clearly. Ransomware attacks are designed to create panic. They hit at the worst time, they encrypt your most critical files first, and they present you with a countdown clock to apply maximum pressure. The businesses that respond well are not the ones with the biggest IT budgets. They are the ones that had a plan written down before anything went wrong.
This does not need to be complicated. A one page document, a list of contacts, and a basic sequence of steps is enough to take the chaos out of the first hour and give you a fighting chance.
What you should do this week,
Read the first hour playbook below and think honestly about whether your business could execute it right now.
Write down the name and number of your IT provider, your cyber insurer if you have one, and your most critical systems. Put it somewhere physical, not just on the computer that may be encrypted.
The tool section gives you a template for an incident response card you can fill in and keep on hand.
THIS WEEK'S TIP 💡
What to do in the first hour of a cyber incident.
Speed matters in the first hour, but so does not making things worse. Here is the sequence that gives you the best chance of containing the damage.
Step one, stop the spread
The first thing to do is disconnect affected devices from the network. Turn off Wi-Fi, unplug ethernet cables, and isolate any device that is showing unusual behaviour. Do not turn the devices off completely unless instructed to by your IT provider, as forensic information can be lost. The goal is to stop the infection reaching other machines on the same network, including any shared drives or cloud sync folders that may still be actively writing encrypted files.
Step two, do not pay anything yet
Ransom demands feel urgent because they are designed to. Do not make any payment decisions in the first hour. Paying does not guarantee you will get your files back, it funds further attacks, and in some cases paying a ransom may have legal implications depending on who the attackers are. This is a decision to make with professional advice, not in a panic at 6pm.
Step three, call your IT provider
If you have an IT provider, call them immediately on their direct number. Not email. Not a support ticket. A phone call. If they have no out of hours cover, that is important information for a different conversation, but try to reach someone now. If you do not have an IT provider, your next call is to a cyber incident response firm. Your cyber insurer, if you have one, will often have a list of approved firms you can call directly.
Step four, call your cyber insurer
If you have cyber insurance, call them now. Most cyber insurance policies include access to an incident response team as part of the cover. This is exactly what that is for. They will guide you through the process, help you understand your obligations, and connect you with specialists. Do not wait until Monday to report it.
Step five, report it
In Ireland, you should report a cyber incident to the National Cyber Security Centre at ncsc.gov.ie. Ransomware and significant data breaches should also be reported to the Data Protection Commission if personal data has been affected. In the UK, report to the National Cyber Security Centre at ncsc.gov.uk and to Action Fraud. Neither report will make the situation worse, and both can provide guidance.
Step six, document everything
Write down what happened and when, as accurately as you can. What did you see first? What time was it? What did you do and in what order? This record matters for your insurer, for any regulatory reporting you may need to do, and for understanding how the attack happened so it does not happen again.
What not to do
Do not try to decrypt files yourself using tools you find online. Do not delete anything. Do not tell your entire team before you have a clear picture of what happened, as this can cause confusion and make it harder to manage the response. And do not assume it is over because one device looks fine.
THIS WEEK'S TOOL 🛠️
The incident response card every SME should have on the wall.
This is not a 40 page policy document. It is a single card with the information you need when you are stressed, the phones are ringing, and you cannot think straight. Print it. Fill it in. Put it somewhere physical.
Your incident response card
IT provider name and direct phone number, including out of hours if available,
Cyber insurer name and claims line number,
NCSC reporting (Ireland, ncsc.gov.ie or UK, ncsc.gov.uk),
Data Protection Commission (Ireland, dataprotection.ie) or ICO (UK, ico.org.uk),
Your most critical business systems and who is responsible for each,
Where your backups are and who has access to them,
Name of the person in your business who takes charge during an incident.
The four questions to answer in the first ten minutes,
What systems are affected?
Is the infection still spreading?
Who have I contacted?
What is still working that I can use to communicate and document?
Keep a copy of this card somewhere it will survive if your computers are unavailable. A printed copy in a drawer is not outdated thinking. It is good planning.
QUICK COMPLIANCE CHECKLIST
Five things to have in place before an incident happens,
Do you have a written list of contacts for your IT provider, cyber insurer, and the relevant reporting authorities?
Do you have cyber insurance that includes incident response support?
Do you have working, tested backups that are stored separately from your main systems and could not be encrypted alongside them?
Does your IT provider offer out of hours support, and do you have their direct number somewhere other than your potentially encrypted computer?
Does at least one person in your business know what to do in the first hour of an incident, and have they ever talked through it with the rest of the team?
BEFORE YOU GO
A fire evacuation plan is a legal requirement for almost every workplace in Ireland and the UK. It is printed, it is on the wall, and everyone knows where the exits are. Nobody waits for a fire to start before working out what to do.
A cyber incident is not less serious than a fire. For many small businesses it is more serious, because the damage is less visible, harder to reverse, and can take months to fully understand. But most of those same workplaces have no equivalent plan for what to do when their systems go down.
You do not need a large IT team to have a plan. You need a printed card, a list of numbers, and one conversation with your team about what happens if things go wrong.
Do it this week, while things are quiet. Not next Friday at 6pm.
See you next week.
The SME Security Brief
Found this useful? Forward it to a business owner who would benefit. It takes two seconds and could save them a serious headache.
You're receiving this because you subscribed at thesmesecuritybrief.com. To unsubscribe, click here.
If you find this newsletter useful and want to show your support, you can buy me a coffee. It genuinely means a lot and keeps this going. No pressure at all.
