Table of Contents
Organizations with a tested incident response plan reduce breach costs by an average of $2.66 million compared to those without one, according to IBM’s 2025 Cost of a Data Breach Report. Yet most Filipino small businesses — operating in a country where 100% of organizations experienced supply chain-related cybersecurity incidents in 2025 — have no documented plan for what to do when an attack happens. When ransomware encrypts your files at 2 AM on a Sunday, the difference between recovering in hours and losing everything is not the firewall you bought. It is the incident response plan you wrote — or did not write — while things were calm.
Key Takeaway
- 🚨 **A tested incident response plan saves $2.66 million on average** — IBM’s 2025 report found organizations with a tested plan reduce breach costs by $2.66M compared to those without one.
- 📋 **The NIST framework has 4 phases** — Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Every plan must cover all four.
- 👥 **Your incident response team needs 4 roles minimum** — Incident Response Leader, IT Contact, Communications Contact, and Legal/Compliance Contact. Each needs a backup.
- 🇵🇭 **Philippine law requires breach notification within 72 hours** — The Data Privacy Act mandates reporting to the National Privacy Commission within 72 hours of discovering a breach involving personal data.
- 🔄 **Test your plan quarterly** — A plan that has never been tested is a plan that will fail. Tabletop exercises and simulation drills build the reflexes your team needs during a real incident.
What Is an Incident Response Plan?
An incident response plan (IRP) is a documented, step-by-step playbook that outlines exactly what your organization does before, during, and after a cybersecurity incident. It defines who is responsible for what, how incidents are detected and classified, how they are contained and resolved, and how the organization recovers and learns from the experience. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) describes the IRP as “your action plan before, during and after a security incident” — emphasizing that it must be written, approved by leadership, and tested in peacetime, not improvised during a crisis.
The NIST SP 800-61r3 framework, updated in April 2025, defines the incident response lifecycle across four phases. The update added guidance on leveraging automation and AI-assisted tools for detection and analysis — reflecting how modern incident response increasingly relies on SIEM, EDR, and threat intelligence platforms rather than manual monitoring alone. For Philippine small businesses, the framework provides a proven structure that scales from a 5-person startup to a 500-person enterprise. For more context on the Philippine threat landscape, see our cybersecurity Philippines complete guide.
The 5 Steps to Build Your Incident Response Plan
Step 1: Preparation — Build Your Team and Your Policy
Preparation is where most incident response plans succeed or fail — because it happens before anyone is under pressure. Start by developing a written policy that defines how your organization manages cybersecurity incidents, what actions must be prioritized, and who leads the response. Keep the plan simple enough that every team member can understand it, but specific enough that there is no ambiguity about who does what.
Assemble your incident response team. CISA recommends including stakeholders from multiple disciplines — not just IT — because cyberattacks have business, operational, customer, and regulatory impacts. At minimum, your team needs four roles:
| Role | Responsibility | Backup |
|---|---|---|
| Incident Response Leader | Coordinates the entire response, makes decisions, escalates to leadership | Deputy from IT or operations |
| IT Contact | Isolates affected systems, conducts forensic analysis, restores from backups | External IT consultant or MSP |
| Communications Contact | Manages internal and external communication, customer notifications, media response | HR or marketing lead |
| Legal/Compliance Contact | Handles regulatory reporting, data privacy compliance, law enforcement coordination | External legal counsel |
Document an emergency contact list with phone numbers, email addresses, and alternative communication channels — printed on paper, not just stored digitally. When the network is down, a contact list on your laptop is useless. CISA’s IRP Basics guide emphasizes that the address book must be accessible even when the network is offline.
Step 2: Detection and Analysis — Know When You Are Under Attack
You cannot respond to an incident you cannot detect. The detection phase is about putting safeguards in place that alert you when something is wrong — before the damage becomes catastrophic. For small businesses, this does not mean buying expensive SIEM platforms. It means enabling the monitoring that your existing tools already provide.
Enable login alerts on all critical accounts — Google Workspace and Microsoft 365 both send alerts for suspicious sign-in activity. Configure your firewall to log denied connection attempts. Turn on endpoint detection through Microsoft Defender for Business (included with Microsoft 365 Business Premium) or free alternatives like ClamAV. Set up alerts for the three indicators that most commonly precede a breach: logins from unusual geographic locations, large data transfers outside business hours, and mass file downloads or deletions.
When an alert fires, classify the incident by severity. A four-level system works for most small businesses:
- Critical — Active ransomware, data exfiltration in progress, or complete system compromise. Immediate response required.
- High — Confirmed unauthorized access, malware detected on a production system, or phishing compromise of an executive account. Response within 1 hour.
- Medium — Suspicious activity detected, isolated malware on a non-production system, or failed intrusion attempt. Response within 4 hours.
- Low — Policy violation, suspicious email reported by user, or minor configuration issue. Response within 24 hours.
Step 3: Containment, Eradication, and Recovery — Stop the Bleeding
When an incident is confirmed, the first priority is containment — limiting the damage. The incident response team isolates affected systems from the network, disables compromised accounts, and blocks malicious IP addresses. The goal is not to fix everything immediately. It is to prevent the incident from spreading.
The containment sequence for a typical ransomware or malware incident follows a specific order:
- Isolate the affected device — Disconnect it from the network immediately. Do not shut it down — powering off can destroy evidence in RAM that is critical for forensic analysis.
- Disable compromised accounts — Reset passwords and revoke active sessions for any account that may have been accessed by the attacker.
- Block malicious indicators — Add attacker IP addresses, domains, and file hashes to firewall and email filter blocklists.
- Preserve evidence — Document the timeline of events, capture system logs, and take memory dumps before making changes. This evidence is critical for forensic analysis and regulatory reporting.
- Eradicate the threat — Remove malware, close vulnerabilities, and apply patches that prevent re-entry.
- Recover systems — Restore from verified, clean backups. Never restore from backups that were connected to the network during the attack — they may be infected too. Test restored systems before reconnecting them to the network.
For a complete guide to building the kind of security architecture that prevents incidents from spreading, see our zero trust implementation guide for small businesses.
Step 4: Post-Incident Activity — Learn From What Happened
After the incident is contained and systems are restored, hold a blameless post-mortem meeting. CISA recommends positioning this as an open forum for sharing lessons learned — not a search for someone to blame. The goal is to understand what happened, what worked, what failed, and what to change before the next incident.
The incident response leader should report on the incident timeline, response metrics, impacts, and remediation measures. Key metrics include Mean Time to Detection (MTTD) — how long it took to notice the attack — and Mean Time to Recovery (MTTR) — how long it took to restore normal operations. These metrics give you a baseline to measure improvement over time.
Update the incident response plan based on lessons learned. If detection was too slow, add monitoring. If containment was messy, clarify roles. If communication was confused, create templates for internal and external notifications. Every incident — and every near miss — is an opportunity to make the plan better. CISA explicitly recommends invoking the IRP even when you suspect a false alarm, because “near misses drive continuous improvements in the aviation industry, and the same can be true for your security program.”
Step 5: Test Your Plan Regularly
A plan that has never been tested is a plan that will fail. CISA recommends quarterly tabletop exercises — walk-through simulations where the team discusses how they would respond to a hypothetical scenario. One month, simulate a ransomware attack. The next, simulate a business email compromise. The next, simulate a vendor supply chain breach.
| Activity | Frequency | Objective |
|---|---|---|
| Tabletop Exercise | Bi-annually | Walk through a “what-if” scenario with the response team |
| Contact List Audit | Quarterly | Verify phone numbers and vendor contacts are current |
| Technical Drill | Annually | Test actual restoration of data from backups |
| Plan Review | Post-incident | Update the plan based on lessons learned |
The Philippine Regulatory Requirement: 72-Hour Breach Notification
For Filipino businesses, the incident response plan is not just a best practice — it is a legal requirement. The Philippine Data Privacy Act of 2012 mandates that organizations report data breaches involving personal data to the National Privacy Commission (NPC) within 72 hours of discovery. The notification must include the nature of the breach, the personal data involved, the approximate number of data subjects affected, and the measures taken or proposed to be taken to address the breach.
Failure to notify the NPC within 72 hours can result in penalties, including fines and imprisonment for responsible officers. The NPC’s Data Breach Notification Management System is the official channel for reporting. Your incident response plan must include the NPC notification as a specific step in the post-incident activity phase, with the legal/compliance contact responsible for preparing and submitting the notification within the deadline.
For organizations that also handle data of EU residents, the EU’s General Data Protection Regulation (GDPR) requires breach notification within 72 hours as well. And under the U.S. SEC’s cybersecurity disclosure rules, publicly traded companies must disclose material cybersecurity incidents within four business days. If your business serves international clients — as many Philippine BPO companies do — your plan must account for multiple regulatory frameworks simultaneously.
Common Incident Response Mistakes Small Businesses Make
- No plan at all — The most common mistake. Without a documented plan, the first hours of an incident are spent arguing about who is in charge instead of containing the damage.
- A plan that was never tested — A 50-page document that nobody has read since it was written is not a plan. It is a paperweight. Tabletop exercises reveal gaps that only appear under pressure.
- IT-only response team — Cybersecurity incidents affect legal, communications, operations, and customer relationships. A team composed only of IT professionals cannot handle breach notification, customer communication, or regulatory compliance.
- No offline contact list — When the network is down, a contact list stored on the company intranet is inaccessible. Print it. Update it quarterly.
- Shutting down infected machines — Powering off a compromised device destroys volatile evidence in RAM. Isolate from the network instead.
- Not reporting to the NPC — Some businesses hide breaches out of fear of reputational damage. The Data Privacy Act’s penalties for non-reporting are more severe than the reputational cost of transparent disclosure.
Frequently Asked Questions About Incident Response Plans
What is an incident response plan and why does my business need one?
An incident response plan (IRP) is a documented playbook that defines exactly what your organization does before, during, and after a cybersecurity incident. IBM’s 2025 Cost of a Data Breach Report found that organizations with a tested incident response plan reduce breach costs by an average of $2.66 million. Without a plan, the first hours of an incident are spent figuring out who is in charge instead of containing the damage — and every hour of delay costs money.
How long does it take to create an incident response plan?
A basic incident response plan for a small business can be drafted in 1-2 days. The NIST SP 800-61r3 framework provides a proven structure. The initial document should define roles, communication protocols, incident classification levels, containment procedures, and the 72-hour NPC notification requirement. The plan should then be reviewed by leadership, tested through a tabletop exercise, and updated based on the results. Plan for 2-4 weeks from first draft to first test.
Who should be on the incident response team?
At minimum, four roles: an Incident Response Leader who coordinates the response and makes decisions, an IT Contact who handles technical containment and recovery, a Communications Contact who manages internal and external notifications, and a Legal/Compliance Contact who handles regulatory reporting. Each role should have a designated backup. CISA recommends including stakeholders from multiple disciplines — not just IT — because cyberattacks have business, operational, and regulatory impacts.
How often should I test my incident response plan?
CISA recommends tabletop exercises at least twice a year, quarterly contact list audits, and annual technical drills that test actual data restoration from backups. The plan should also be reviewed and updated after every security incident or near miss. An untested plan is not a plan — it is a document that will fail when you need it most.
What is the 72-hour breach notification requirement in the Philippines?
The Philippine Data Privacy Act of 2012 requires organizations to report data breaches involving personal data to the National Privacy Commission (NPC) within 72 hours of discovery. The notification must include the nature of the breach, the personal data involved, the number of data subjects affected, and measures taken to address it. Failure to notify within 72 hours can result in penalties including fines and imprisonment for responsible officers.
What is the first thing I should do during a cybersecurity incident?
The first action is containment — isolate the affected system from the network immediately. Do not shut it down, as powering off destroys forensic evidence in RAM. Disable any compromised accounts, block known malicious indicators, and contact your Incident Response Leader. Document every action you take with timestamps — this documentation is critical for forensic analysis, regulatory reporting, and potential legal proceedings.
Can a small business afford an incident response plan?
Yes. A basic incident response plan costs nothing but time — it is a document, not a product. The NIST framework and CISA’s IRP Basics guide are free. The monitoring tools needed for detection (login alerts, firewall logging, endpoint detection) are included in Google Workspace and Microsoft 365 Business Premium. The most expensive part of not having a plan is the breach itself — IBM reports the average cost of a data breach in Southeast Asia is $2.7 million. A plan that costs a weekend to write can save your business.
This article is for informational purposes only and does not constitute professional cybersecurity or legal advice. Organizations should consult with qualified IT security professionals and legal counsel when developing their incident response plans. For Philippine-specific guidance, refer to the National Privacy Commission and the Department of Information and Communications Technology (DICT).
