Incident response plan. Three words that could mean the difference between a 48-hour recovery and a six-month nightmare. If your business experienced a cyberattack tonight, would your team know exactly who to call, which systems to isolate, and how to communicate with clients by morning? For most businesses across Northeast and North-central Wisconsin, the honest answer is no.
That gap is more common than you might expect. According to industry research, up to half of small and medium businesses have no formal incident response plan in place. Yet the 2025 Verizon Data Breach Investigations Report found that 88% of breaches involving small businesses contained a ransomware component. The attacks are happening. The question is whether your business will respond with a tested playbook or scramble in the dark.
Whether you handle IT internally or rely on an IT company that has never raised this topic, this guide walks through what a response plan actually includes, how to build one that fits your business, and why testing matters more than the document itself.
What an Incident Response Plan Covers (and What It Doesn’t)
An incident response plan is a documented, step-by-step playbook that tells your team exactly how to detect, contain, and recover from a cybersecurity incident. It assigns specific roles, defines communication protocols, and outlines technical procedures so that decisions happen fast when every minute counts.
A response plan is not the same as a disaster recovery plan or a business continuity plan, though the three work together. Disaster recovery focuses on restoring systems and data after a disruption. Business continuity addresses how your operations keep running during an outage. Incident response sits upstream of both. It covers the immediate actions your team takes the moment a security incident is identified, long before recovery begins.
Think of it this way: your response plan tells you how to stop the bleeding. Your disaster recovery plan tells you how to heal. Your business continuity plan keeps the rest of the body functioning while both happen. Unfortunately, many businesses that confuse these three often discover the gaps at the worst possible time.
Why Most Small Businesses Don’t Have a Security Incident Plan
The numbers tell a consistent story. The Hiscox Cyber Readiness Report found that 41% of small businesses experienced a cyberattack in 2023, with a median cost of $8,300 per incident. Small businesses face cyberattacks at nearly the same rate as larger organizations, yet most lack a formal security incident plan to guide their response.
So why the disconnect? For businesses managing IT internally, the answer usually involves bandwidth. Your office manager, operations director, or small IT team already juggles a full workload. Building a comprehensive cyber incident response plan requires specialized knowledge of threat detection, forensics, legal obligations, and communication protocols. Without that expertise in-house, the project stalls indefinitely.
For businesses paying an IT company for support, the situation is different but equally concerning. Many assume their provider has already handled incident response planning as part of the monthly fee. In reality, a significant number of IT companies operate reactively. They fix what breaks and keep systems running, but they never sit down with your team to document response procedures, assign roles, or run a tabletop exercise. If your current IT company has never walked you through a documented response playbook, you likely do not have one.
Both scenarios leave businesses across Green Bay, Appleton, Oshkosh, and the broader Fox Valley region exposed to the same risk: when an attack happens, there is no playbook. The first hour is consumed by confusion instead of containment.
The Six Phases of Effective Incident Response Planning
The National Institute of Standards and Technology (NIST) outlines a widely accepted framework for incident response planning. Here is how each phase works for a small or mid-sized business.
1. Preparation
Preparation is everything that happens before an incident occurs. Identify your critical systems, document your network architecture, establish communication chains, and define what constitutes a security incident for your organization. A manufacturing company in the Fox Valley has different critical systems than a healthcare provider in Green Bay. Your plan should reflect your specific operations.
2. Identification
Detection is where most small businesses struggle. Without monitoring tools and clear escalation procedures, incidents go unnoticed for weeks or months. The IBM 2024 Cost of a Data Breach Report found that the average breach lifecycle is 258 days from identification to containment. Faster identification means less damage, lower costs, and a shorter path to recovery.
3. Containment
Once a threat is confirmed, containment focuses on limiting the damage. Short-term containment isolates affected systems immediately. Long-term containment involves temporary fixes that keep business operations running while your team prepares for full remediation. Having these steps documented in advance prevents reactive decisions that can make the situation worse.
4. Eradication
After containment, your team removes the threat completely. Eradication may include removing malware, closing exploited vulnerabilities, resetting compromised credentials, and applying patches. Rushing this phase often leads to reinfection, which is why a structured response plan is critical.
5. Recovery
Recovery brings affected systems back online in a controlled manner. Restoring from verified clean backups, monitoring for signs of continued compromise, and validating that systems operate normally all fall within this phase. Our post on data recovery versus data backup explains why having the right backup strategy makes this phase far more manageable.
6. Lessons learned
The final phase is the one most organizations skip, and it may be the most valuable. After every incident, conduct a formal review. What worked? What failed? Does something need to change in the plan? Documenting these findings strengthens your cybersecurity incident response plan for the next event, because there will be a next event.
Who Builds and Executes Your Response Plan
Here is the question that nearly every competing article on this topic ignores: who actually builds and runs a response plan for a business with 15, 50, or 150 employees?
Most small and mid-sized businesses lack the in-house security expertise to build, test, and execute a cyber attack incident response plan on their own. Enterprise organizations have dedicated security operations centers (SOCs) and full-time incident response teams. Small businesses do not, and the gap between needing a plan and having the resources to create one is where most companies get stuck.
If your business handles IT internally, you face a practical reality. Building a quality plan requires knowledge of forensic procedures, regulatory reporting requirements, threat intelligence, and recovery protocols. An office manager or generalist IT employee rarely has this background, through no fault of their own.
If your business works with an IT company, the plan should already exist. A qualified IT partner takes ownership of incident response planning as a core part of the relationship. The partner builds the plan collaboratively with your leadership team, documents roles and responsibilities for both sides, and tests the plan on a regular schedule. If none of that has happened, your current IT relationship has a significant gap.
At M2 Technology, we start every response engagement by sitting down with the people who run your business. We learn your operations, identify what matters most, and then build a plan around how your team actually works. Technology is part of the solution, but the plan only succeeds when everyone understand their roles and trusts the process. That approach reflects our core belief that the best outcomes happen when people work together toward shared goals.
How to Test Your Response Plan
A plan that sits in a binder on a shelf is not a plan. It is a document. An untested incident response plan provides a false sense of security that can be more dangerous than having no plan at all.
Incident response tabletop exercises are the most practical testing method for small and mid-sized businesses. A tabletop exercise gathers your key decision-makers around a table (or video call) and walks through a realistic scenario step by step. No systems go down. No data is at risk. The exercise simply tests whether your team knows what to do when a specific type of incident occurs.
Effective tabletop exercises include a few essential elements:
- Realistic scenarios: Base the exercise on threats relevant to your industry and region. A phishing-based ransomware attack is far more likely for a Northeast Wisconsin business than a nation-state APT campaign.
- Role-specific questions: Test whether each person knows their specific responsibilities. Can your controller explain the financial notification process? Does your operations manager know which systems to prioritize for recovery?
- Time pressure: Add realistic time constraints. Many response failures happen because teams take too long to make decisions during the critical first hours.
- Honest evaluation: After the exercise, document what went well and what broke down. Update the plan accordingly.
We recommend testing your plan at least twice per year, with additional exercises after any major change to your IT environment, staff, or business operations. Businesses in regulated industries like healthcare or financial services may need quarterly exercises to meet compliance requirements.
Cyber Insurance and Your Response Readiness
Cyber insurance carriers are paying closer attention to incident response planning than ever before. Many underwriters now require a documented, tested plan as a condition of coverage. Others offer meaningful premium reductions for businesses that can demonstrate mature response capabilities.
Cyber insurance providers increasingly require a documented, tested response plan as a condition of issuing or renewing coverage. If you apply for coverage without one, you may face higher premiums, reduced limits, or outright denial.
Beyond meeting insurance requirements, a strong response plan also protects your claim in the event of a breach. Insurers evaluate whether you followed your documented procedures during an incident. If your response deviated significantly from the plan (or if no plan existed), the carrier may dispute portions of your claim. Proper incident response planning protects both your operations and your financial recovery.
At M2 Technology, we help businesses throughout Northeast Wisconsin build response plans that satisfy insurance requirements while providing genuine protection. We also coordinate directly with cyber insurance carriers during the claims process, ensuring that our clients have expert support when they need it most.
Getting Started With Incident Response Planning
Building your first response plan can feel overwhelming, but the process becomes manageable when broken into clear steps:
- For businesses without an IT partner: Start by identifying your critical assets, meaning the systems, data, and processes your business cannot operate without. Document who currently manages those assets and how your team would communicate during an outage. Even a basic plan built around these fundamentals puts you ahead of the majority of small businesses. From there, consider engaging a qualified IT partner who can bring the technical depth your plan needs.
- For businesses with an existing IT company: Ask a direct question. “Can you show me our incident response plan?” If the answer involves hesitation, qualifications, or a promise to build one soon, you have important information about the maturity of that relationship. A qualified partner should be able to produce a documented, tested plan that reflects your current environment and business needs.
A typical engagement with the right partner looks like this: an initial assessment of your environment, a collaborative planning session with your leadership team, a documented plan with clear roles and procedures, and a scheduled tabletop exercise to validate everything works. The entire process usually takes weeks, not months.
Final Thoughts
A response plan is not a document you create once and file away. It is a living capability that grows stronger every time you test it, update it, and learn from it. The businesses across Northeast Wisconsin that recover quickly from cyber incidents are not the ones with the biggest IT budgets. They are the ones that were the most prepared before the crisis arrived.
Whether you currently manage IT on your own or suspect your IT company has left this critical piece unfinished, the most important step is starting. At M2 Technology, we work with businesses throughout Green Bay, Appleton, Oshkosh, and the greater Fox Valley to build incident response capabilities that hold up when it matters most. Our approach starts with understanding your people and your operations, because the best technology in the world fails without a team that knows how to use it.
If you want to evaluate where your business stands, we offer a complimentary cybersecurity assessment. Chat with an expert about building the response capabilities your business needs today.