Your business has invested in cybersecurity software, installed firewalls, backed up important files, and trained employees to spot suspicious emails. On paper, your business seems ready for a cyberattack.
But then an employee sees a ransom note on their computer. Another finds messages in their email account that they didn’t send. Your team can no longer access important files, and nobody knows whether the problem affects one device or the entire network.
Who should they contact? Should they turn off and disconnect their computers or leave them running? Would restarting an affected device help, or could it make the situation worse?
Having security measures is important, but it’s only the first step. Your team also needs to know what to do when an attack gets through. Employees may hesitate because they fear making a mistake, while others may try to fix the problem without understanding the risks. Without clear instructions, they may waste valuable time or take actions that allow cybercriminals to compromise systems and steal information.
Incident response is the process of identifying, managing, and recovering from a cybersecurity incident. It gives employees and IT responders a clear plan for limiting damage, protecting business information, and restoring normal operations.
Why aren’t cybersecurity tools enough?
Cybersecurity tools can detect suspicious activity and block many common threats, but an effective response also depends on employees knowing how to recognize and report potential incidents.
Consider an employee who enters their work password on a fraudulent website. They realize what happened but hesitate to report it because they fear getting in trouble. In the meantime, a criminal may use the stolen credentials to access company email or shared files.
Reporting the incident promptly gives your IT team a chance to secure the account, check for unauthorized access, and limit further damage.
What should your team do during a cyberattack?
A written incident response plan outlines what employees should do when they notice a possible security issue. The right response depends on the threat and the systems involved, but everyone should know how to report a suspected incident and what steps to take next.
1. Recognize and report suspicious activity
Employees should know how to recognize potential signs of a cyberattack and report them promptly, rather than waiting for clear evidence that an attack is underway.
Common indicators include:
- Unexpected password reset requests or login alerts
- Unusual emails sent from a company account
- Files that suddenly become inaccessible
- Messages asking for payment to unlock data
- Security alerts about unfamiliar devices or account activity
An unusual event may have an innocent explanation, but employees shouldn’t assume everything is fine. They should report the concern instead of trying to investigate it themselves. Identify the right person to contact when a security issue arises. They should also know whom to contact about security issues and how to reach IT support if they suspect that company email or messaging tools may be compromised.
Encourage employees to report mistakes without fear of blame. Prompt reporting helps the IT team respond quickly and limit potential damage.
2. Notify the right people
Your incident response plan should identify who leads the response, who handles technical work, and who communicates with employees and customers. In a small business, one person may fill several roles, but everyone should know who has authority to make key decisions.
Keep emergency contact details available through an alternative method, such as a printed contact list. This ensures employees can still reach IT support and management if attackers compromise company email or collaboration tools.
Depending on the incident, your business may need to contact its cyber insurance provider, legal counsel, or a relevant regulatory authority. Legal and reporting obligations vary by incident, industry, and jurisdiction. Consult qualified advisers when sensitive or regulated information may be involved.
Employees should avoid sharing unverified details outside the response team or posting about the incident publicly. Designated representatives can provide updates while the IT team investigates what happened.
3. Follow instructions to contain the threat
After receiving a report, the IT team can assess the situation and take steps to prevent the problem from escalating.
Depending on the circumstances, responders may tell an employee to disconnect an affected computer from the network, stop using a compromised account, or avoid certain systems while they investigate. Employees should follow established procedures rather than attempt their own fixes. Restarting a device, deleting suspicious files, or wiping a computer could disrupt the investigation or destroy useful evidence. Acting quickly is important, but employees should leave technical decisions to authorized responders and follow their instructions.
Which incident response mistakes should your business avoid?
Even when employees recognize a potential cyberthreat, they can still make mistakes under pressure. Knowing what to avoid can help prevent a manageable incident from becoming more disruptive.
Waiting to see if the problem goes away
An employee might dismiss an unfamiliar login alert or assume an unusual computer problem will resolve itself. Delaying a report can give an attacker more time to access accounts or systems.
Trying to fix the problem without guidance
Employees may unintentionally interfere with the investigation by changing account settings, deleting files, or running unfamiliar tools. Even well-intentioned actions can complicate recovery or make it harder to identify the source of the incident. For instance, if a password may have been compromised, they should use the approved reporting process and wait for instructions before taking further action. This helps preserve evidence and allows responders to identify how the attacker gained access.
Assuming backups will solve everything
Backups help businesses recover lost or damaged data, but they don’t remove an attacker from a network or fix the weakness that allowed access. Criminals may also target backup systems, damage stored copies, or access sensitive information before the business detects the intrusion.
Before restoring data, your IT team should contain the attack, address the security weakness, and verify that the backups are intact and safe to use. Restoring an infected system or compromised files without these checks could reintroduce the threat. Regular recovery tests can help confirm that your business can restore important data when needed.
How can you prepare your team before an attack?
Preparing your team means more than documenting what to do during a cyberattack. Employees and managers need to understand their responsibilities, practice making decisions under pressure, and know which systems to prioritize during recovery. These steps help turn your incident response plan into a practical guide your team can follow when an attack occurs.
Create and review your incident response plan
Document the steps your business will put into action during a cyberattack. Keep the instructions practical, with clear procedures for escalating concerns, assigning responsibilities, and making key decisions.
Store a copy somewhere employees can access if company email, shared drives, or other systems become unavailable. Review the plan when significant changes occur in your technology, staff, or business operations.
Practice with realistic scenarios
A tabletop exercise lets employees and managers discuss how they would respond to a cyberattack without disrupting normal operations. For example, present a scenario in which ransomware prevents staff from accessing important files. Ask participants to explain how they would coordinate the response, make urgent business decisions, and communicate if normal systems were unavailable.
Record any gaps the exercise reveals, such as unclear authority or missing procedures. Assign responsibility for fixing those issues, then revisit them during a future exercise.
Set recovery priorities
Your business may not be able to restore every system at once after a cyberattack. Identify which systems and business functions are critical to your operations, and establish realistic expectations for how quickly they need to be restored.
Work with your IT provider to establish recovery requirements, including how quickly critical systems must be restored and how much data loss your business can tolerate. Identify potential delays, such as restoring large amounts of cloud data, recovering compromised accounts, or replacing damaged equipment. This preparation helps you set realistic recovery expectations and plan for business interruptions.
Is your business ready to respond to a cyberattack?
A cyberattack can test your business’s ability to make decisions, protect critical information, and keep operations running. Having the right support in place can help you navigate these challenges with greater confidence.
Tech Partners Hawaii can help you assess your IT environment, address cybersecurity gaps, and prepare for potential disruptions. Contact our team today to get started.