Ransomware does not wait for a committee. The first thirty minutes are messy: half-encrypted files, a blinking help desk phone, and people asking whether to shut everything down. What your small team does in that window often decides whether the incident becomes a contained bad day or a week-long outage. You do not need a Fortune 500 incident response plan. You need a one-page playbook that tells people exactly who does what, in what order, and how to talk to each other when email and chat may already be compromised.
Build a One-Page Playbook, Not a Binder
Small teams fail at response because the plan is too long to read during a crisis. Keep the core playbook to one page. Print it. Store copies offline: in the office, at home, and in a go-bag. If file shares and email are encrypted, a cloud-only copy may be unreachable.
Write in plain language. "If files start renaming themselves with a strange extension, stop work, unplug the network cable, and call the incident lead" is better than "execute containment protocol." The page should include four roles, a first-30-minutes checklist, key contacts, and decision rules. Everyone should know where to find it and what their first action is.
What belongs on the one-pager
- Four roles plus backups: Incident Lead, Isolation Lead, Communicator, Scribe.
- An escalation tree with mobile numbers and one out-of-band channel.
- A checklist split into three columns: Stop, Preserve, Communicate.
- Pre-approved message templates for staff, customers, and vendors.
- Decision rules: who can authorize legal counsel, forensics help, or a server shutdown.
Assign Roles Before the Alert
Assign roles based on decision rights and temperament, not job titles. In a fifteen-person company, the operations manager may be the Incident Lead, the IT generalist may be the Isolation Lead, a calm project coordinator may handle communication, and someone detail-oriented can take notes.
- Incident Lead: the single decision-maker. Declares the incident, owns the clock, approves containment steps, and updates leadership. This person should not be troubleshooting.
- Isolation Lead: executes technical containment. Disconnects systems, disables accounts, blocks network paths, and protects backups.
- Communicator: sends internal updates, handles customer and vendor calls, and manages media inquiries if they come. Uses approved scripts and does not speculate.
- Scribe: records timestamps, actions, decisions, and evidence locations. This log becomes essential for insurance, legal, and recovery.
Name backups for every role. If the Incident Lead is unreachable, someone must step in without a debate. Give each person a card with their first three actions.
Minutes 0-5: Confirm, Declare, and Stop the Spread
The first report often comes from an employee who cannot open a file or sees a ransom note. Treat it as real until proven otherwise. The Incident Lead declares an incident, even if the evidence is thin. A false alarm costs thirty minutes. A delayed alarm can cost the company.
Immediate actions
- Tell the person who reported it to stop working and leave the device powered on.
- Disconnect the affected device from the network: unplug the Ethernet cable, disable Wi-Fi, or disconnect from VPN.
- Do not shut down or reboot unless the Incident Lead or a forensic advisor instructs it. A powered-on machine can preserve memory evidence.
- Ask other staff to stop using shared drives and email until the scope is clear.
- Start the Scribe log with time, reporter, device name, and what was seen.
If multiple machines are affected, assume the network is compromised. Containment beats investigation in the first five minutes.
Minutes 5-15: Isolate Systems and Protect Backups
The Isolation Lead now moves from one device to the environment. The goal is not to clean malware. The goal is to stop encryption from spreading and keep recovery options alive.
- Disconnect backup appliances and NAS devices from the network. If backups are online and reachable, ransomware can encrypt them too.
- Disable shared accounts, service accounts, and remote access tools that are not needed for response.
- Block outbound traffic from affected segments if you can do so safely. If not, unplug first and ask questions later.
- Check whether offline or immutable backups exist. Do not connect them to the network until they are verified clean.
- Photograph ransom notes, error messages, and renamed file extensions. Do not click links or reply to attackers.
If you use a managed service provider, call their emergency line. Give them the facts: what you see, when it started, what you have disconnected. Do not let them reconnect systems without Incident Lead approval.
Minutes 15-25: Communicate on a Separate Channel
Assume email, chat, and your phone system may be compromised or unreliable. Switch to a pre-agreed out-of-band channel: mobile calls, a group text, or a separate messaging app that was set up before the incident. Share only confirmed facts.
The Communicator should send a short internal message. It should tell people what to do, not ask them to speculate.
We are responding to a security incident. Please stop using company email and file shares. Disconnect from VPN if you are working remotely. Do not delete anything or try to fix your computer. Wait for a call or text from the incident team at [number]. We will update you by [time].
Next, prepare holding statements for customers and vendors. Keep them factual: "We are investigating a security incident and have taken systems offline as a precaution. We will provide updates as we learn more." Do not admit fault, promise timelines, or discuss ransom demands. If the incident may involve personal data, loop in legal counsel early. Breach notification
Photo: Antoni Shkraba / Pexels
