We have no incident response plan, where do we start?

An IR plan for an SMB does not need 50 pages. One sheet with the right names, numbers and first five steps beats a polished document nobody opens when it counts.

Try this first

1. 1List the people: who is incident lead (usually exec or IT lead), who handles internal comms, who handles customer comms, who calls outside parties (insurer, IR partner, DPA). Name, phone (personal and work), backup person.
2. 2List the externals: cyber insurer (24x7 number), IR retainer (if any), bank (recall procedure), data protection authority (breach form), maybe police and NCSC. Phone numbers for emergencies, not email addresses.
3. 3Describe the first 4 hours per scenario briefly: ransomware (isolate, do not power off, preserve logs, call insurer), BEC (revoke sessions, audit inbox rules, call finance), data breach (start the 72-hour clock, open the DPA form).
4. 4Agree where communication happens. Mail might be compromised, then a Signal or WhatsApp group with a pre-defined list works. Not default Teams if it might be read by an attacker.
5. 5Test once a year with a tabletop. 90 minutes with a scenario, walk through who does what, then update the plan based on the gaps you found.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.