Your Incident Response Plan Is a PDF Nobody Has Opened

Quick gut check. Where is your cyber incident response plan right now? If the answer is "a PDF in a shared drive somewhere", congrats, you are in the majority and also in trouble. Ransomware does not care how nice the formatting is. This post is the lean-team version of getting ready: one plan people can actually find, one drill, and backups you have really restored.

Nothing here needs a big budget. It needs a couple of afternoons and someone willing to own it.

What a cyber incident response plan actually is

Strip the jargon and it is a short written answer to "what do we do when something breaks, and who does it". Detect it, contain it, recover, tell the right people. That's it. NIST's current guidance, SP 800-61 Rev. 3, was published in April 2025 and replaces the 2012 version. Its big shift is treating incident response as part of everyday cybersecurity risk management instead of a separate binder you dust off in a crisis.

That framing is the useful part for a small team. Your plan should live next to how you run the company, not in a folder labeled "compliance".

Why the plan in your drive is not the plan

Think about what happens during a ransomware incident. Your laptops are locked, your file shares are encrypted and your email might be down too. Now go open that PDF. The CISA #StopRansomware Guide says to keep a hard copy of your incident response plan and an offline version, for exactly this reason.

The same guide says to create, maintain and regularly exercise a basic plan, plus a communications plan covering response and notification for ransomware and data extortion. It also says the CEO or equivalent should review and approve both in writing. So no, this is not just an IT thing. If the boss has not signed off, it is a wish.

What a lean team's plan needs

You do not need forty pages. You need these, written down, short enough that a stressed human can read them at 2am:

• Who decides. One named person who makes the calls, and a backup for when they are on a plane.

• Who does the hands-on work. Your IT person, your managed provider or an outside responder you have already talked to.

• First moves. Who isolates affected machines, who preserves evidence, who starts the log of what happened and when.

• Who talks to customers and the press. One voice, with a draft holding statement ready.

• How you will communicate if email is down. Phone numbers, an out-of-band chat, whatever works without your normal systems.

If you are a growing company without anyone senior owning this, that is usually the moment to bring in a leader part time. Our guide to when to hire a fractional CISO walks through how to tell.

Run a tabletop exercise before you need one

A tabletop exercise is a pretend bad day you talk through together. No servers get touched. Somebody reads out a scenario ("it's Friday, files are renamed and there's a ransom note") and everyone says what they would do, who they would call, what they would not know.

It feels a little silly the first time. It is also the fastest way to find out your plan has holes. CISA publishes tabletop exercise packages, and per CISA's own page, each one is customizable and includes template exercise objectives, scenarios and discussion questions. They cover ransomware, insider threats and phishing, plus pre-incident, response and post-incident recovery discussion. The documentation also includes an invitation template, a slide deck, a feedback form and an after action report.

Pick the ransomware scenario, book ninety minutes, invite the people who would really be in the room, and write down every "uh, I don't know". That list is your to-do list.

Backups you have actually restored

Here is the uncomfortable bit. Having backups is not the same as being able to recover. CISA's guide recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario.

Two details from that guide are worth tattooing somewhere. First, it says automated cloud backups may not be sufficient, because if local files are encrypted by an attacker, those files can sync to the cloud and overwrite data that was fine. Second, it notes ransomware actors often hunt for credentials in the environment and use them to reach backup solutions. A backup that your everyday admin login can delete is a backup an attacker can delete.

So run a restore. Pick one important system, bring it back from backup somewhere safe, and time it. How long it took is your real recovery number, and it is probably not the number in your head.

The call list and the words you will need

When it hits, you will spend a surprising amount of time deciding what to say and to whom. Do that thinking now. The CISA guide asks for communications procedures and templates for incident holding statements, plus agreement on how much detail is shared inside the company and with the public.

It also points out that breach notification rules depend on where you operate and what data was involved. State laws apply, health information can bring in federal rules, and you should talk to legal counsel when needed. Put your lawyer's number on the call list before you need it.

Print the list. Seriously. Keep a copy offline.

What to do this week

• Find your current plan. If there isn't one, write a one-pager covering the five items above.

• Print it and save an offline copy. Get a written yes from whoever runs the company.

• Book a ninety minute tabletop and use a ransomware scenario.

• Restore one real system from backup and write down how long it took.

• Come back in a quarter and do it again.

If you want a second set of eyes on any of this, the advisory services at The Millennial CISO cover fractional security leadership for exactly this kind of readiness work.