Free incident response plan template for Australian small businesses
Free incident response plan template for Australian small businesses: a one-page plan with roles, first-hour steps, who to call and 2026 reporting deadlines.
An incident response plan template is a one-page, fill-in document that tells your team what to do in the first hours of a cyber attack: who leads, who to ring, what to disconnect and what to keep as evidence. Key IT's free version below is written for Australian small businesses and includes the reporting deadlines that apply in 2026.
Why does a small business need an incident response plan?
Because the middle of an attack is the worst moment to hunt for your insurer's policy number or argue about who can authorise shutting down the server. In its guide to preparing a data breach response plan, the OAIC says all entities should have one, with a current list of response team members and a second point of contact for every role. A written plan is also on our cyber insurance renewal checklist.
One page everyone can find beats a thick manual nobody has opened. Print it too, because a plan saved only on an encrypted file server is no use to anyone.
What goes in a one-page incident response plan template?
Seven parts, in the order you will reach for them. Copy Parts 1 to 7 onto your letterhead, replace each [square bracket] with your own details, then print two copies and keep one away from the office.
Part 1: Roles and contacts
Give every role a backup and record mobile numbers. A compromised mailbox is no place to coordinate a response.
| Role | What they do | Name and mobile | Backup |
|---|---|---|---|
| Incident lead | Runs the response, keeps the timeline, makes the calls in Part 3 | [Name, mobile] | [Name, mobile] |
| Decision-maker | Approves shutdowns, spending and anything said publicly | [Owner or director] | [Name, mobile] |
| IT provider | Contains, investigates and restores | [Company, after-hours number] | [Second contact] |
| Privacy contact | Runs the data breach assessment and its records | [Name, mobile] | [Name, mobile] |
| Cyber insurer | Takes the claim notice; may have its own hotline or panel of responders | [Insurer, policy number, hotline] | [Broker] |
| Lawyer | Advises on notification duties and wording | [Firm, contact] | [Second contact] |
| Bank | Fraud team that can try to stop a payment | [Fraud line from the bank's website or card] | [Business banker] |
Part 2: First-hour steps
Money moved or bank details changed?
Ring the bank's fraud line before anything else. ASIC's guidance on what to do if your business has been scammed says to act fast and ask the bank to stop any transactions. See how a payment redirection scam works.
Start the timeline
Note when the problem was spotted, by whom and what they saw, then log every action and call.
Isolate, don't power off
Pull the network cable and switch Wi-Fi off on any affected computer but leave it running, because shutting down can destroy evidence.
Don't clean up yet
No wiping, reinstalling or deleting suspicious emails until your IT provider agrees.
Call the incident lead and your IT provider by phone, not email, in case a mailbox is compromised.
Don't reply to or pay the attacker until the decision-maker, IT provider and insurer have spoken.
Tell your insurer
Check the policy for notice requirements and whether it expects you to use its responders.
Ask whether personal information is involved
If it might be, the 30-day assessment window in the table below may already be running.
Part 3: Who to call outside the business
- Bank fraud team: [number].
- ASD's Australian Cyber Security Centre hotline: 1300 CYBER1 (1300 292 371), open 24/7. Report the cybercrime itself through ReportCyber at cyber.gov.au; ASIC notes those reports go to the relevant police jurisdiction.
- IDCARE's Small Business Cyber Resilience Service: 1800 595 170, weekdays 8am to 6pm AEST. The recovery help is free for small businesses and sole traders with no more than 19 full-time-equivalent staff.
- The OAIC: only if your assessment finds an eligible data breach (see the table below).
Part 4: Evidence to preserve
- The ransom note (photograph the screen) and every message exchanged with the attacker, with dates and times.
- Suspicious emails, left in place, plus screenshots of forwarding and inbox rules before anyone removes them. Our Microsoft 365 compromise checklist shows where to look.
- Sign-in, audit, firewall and VPN logs, exported before they are overwritten.
- Payment records: the invoice, the altered bank details and the transaction receipt.
- A list of the personal information that may have been reached, and whose it is.
If an in-scope business pays a ransom, the Home Affairs ransomware payment reporting factsheet says the report must cover the demand, the payment, and the nature and timing of communications with the attacker.
Part 5: Communications
One voice
Only [decision-maker] speaks to clients, media or social media about the incident.
Staff script
"We're working through an IT issue. Please send questions to [incident lead]."
Clients
If your mailbox sent fake invoices, phone the clients affected and ask them to confirm bank details by voice before paying. Otherwise hold the detail until your lawyer has checked the wording.
Regulator
If the Notifiable Data Breaches scheme applies, the statement to the OAIC must give your business's identity and contact details, describe the breach, list the kinds of information involved and recommend steps people should take.
Part 6: Recovery
- Lock the attacker out first: reset passwords, end every active session and delete any MFA method they registered.
- Restore from backups taken before the compromise, and check them before they go back into use.
- Close the gap they came through, whether an unpatched firewall, a reused password or an account without MFA.
- Record what was restored, from which backup and when.
Part 7: Review
- Meet within [two] weeks of recovery: how they got in, what worked, what slowed you down.
- Rehearse every [six] months with a 30-minute walk-through of one scenario, such as "the accounts inbox is sending fake invoices".
- Plan owner: [Name]. Last reviewed: [Date].
Which Australian reporting deadlines apply after a cyber incident?
One incident can set off several reports, each on its own clock. These four are the ones to know. This is general information as at October 2026, not legal advice, so confirm your position with your lawyer.
| Report | Who it applies to | What triggers it | Deadline | Where it goes |
|---|---|---|---|---|
| Notifiable Data Breaches scheme | Businesses and not-for-profits turning over more than $3 million, plus some of any size, such as private health service providers, credit providers and anyone trading in personal information | Personal information accessed or disclosed without authorisation, or lost, in a way likely to cause serious harm that remedial action can't prevent | Assess a suspected breach within 30 calendar days; notify as soon as practicable | A statement to the OAIC, plus notice to the people at risk |
| Ransomware or cyber extortion payment report | Businesses with turnover above $3 million in the previous financial year, and responsible entities for critical infrastructure assets | A ransom or extortion payment, including a non-monetary benefit or a payment made on your behalf | 72 hours from paying, or from learning someone paid for you | The Australian Signals Directorate's reporting form on cyber.gov.au |
| Cybercrime report | Any business (voluntary) | Any cybercrime or cyber security incident | As soon as you can | ReportCyber, or the 24/7 hotline for urgent help |
| Bank fraud report | Any business that has sent or lost money | A payment to the wrong account, or changed bank details | Straight away | Your bank's fraud line |
Two points catch businesses out. The Cyber Security Act 2024 duty starts with the payment, not the attack: Home Affairs says no mandatory report is needed if nothing was paid. And its education-first phase ended on 31 December 2025, with a more active regulatory focus from 1 January 2026. Our explainer on the 72-hour ransomware payment reporting rule covers penalties and who lodges the report.
How does Key IT help when the plan is needed?
Key IT's incident response runs in six steps: detect, contain, investigate, eradicate, recover and report, with support through the regulatory reporting that follows. If Key IT manages your IT, write 1300 053 948 into Part 1. Helpdesk hours are weekdays, 8am to 5pm. After that, managed clients with an urgent problem can call an engineer from Key IT's rotating on-call roster, and attack monitoring carries on at night and at weekends under Key IT's 24/7 SOC service.
Attackers look for your backups while they are inside the network, so Part 6 depends on copies they can't delete. Key IT's disaster recovery and business continuity service uses immutable storage with separate authentication, and contracted clients get regular restore testing. For context, read how a ransomware attack plays out, stage by stage.
Frequently asked questions
Do small businesses really need a written incident response plan?
Yes, if you hold client or staff information. The OAIC's guidance says all entities should have a data breach response plan, and a cyber insurer may ask about one at renewal. The 30-day breach assessment and the 72-hour ransom payment report both run while you are busy recovering, so naming in advance who decides and who reports matters.
What's the difference between an incident response plan and a data breach response plan?
A data breach response plan, the OAIC's term, centres on personal information: contain, assess, notify and review. An incident response plan covers any cyber incident, including ransomware or a redirected payment where no personal data is touched, and adds technical containment and recovery. One document can do both jobs, as this template does.
How often should we test our incident response plan?
The OAIC says to review and test a plan regularly, with how often depending on your size, the nature of your operations, the harm a breach could cause and how much sensitive information you hold. It suggests a review can coincide with new systems or services. A short scenario walk-through twice a year, plus an update whenever a named person leaves, is a practical rhythm.
If we don't pay a ransom, is there still something to report?
Possibly. The 72-hour Cyber Security Act 2024 report only applies once a ransom or extortion payment has been made by, or for, an in-scope business. But if your business is covered by the Notifiable Data Breaches scheme, that scheme may still apply when the attacker reached personal information and serious harm is likely. Home Affairs also encourages voluntary reports of incidents to ASD.
Who should be the incident lead in a small business?
Someone calm, organised and usually on site, such as an operations or practice manager, rather than automatically the owner. The lead runs the timeline and phone calls; the decision-maker approves spending, shutdowns and public statements. Splitting the two stops one person becoming the bottleneck, and each role needs a backup.
Can Key IT help if we're not already a client?
Yes. Key IT helps businesses facing a suspected breach whether or not they are existing clients: call 1300 053 948 between 8am and 5pm on weekdays. Managed clients also get after-hours cover: on-call engineers for urgent problems and 24/7 SOC monitoring. Outside those hours, non-clients can ring ASD's 24/7 hotline on 1300 CYBER1.
Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.