Small Business Guide: Response & Recovery
Guidance that helps small to medium sized organisations prepare their response to and plan their recovery from a cyber incident.
Page 1 of 7
It’s natural for all organisations to experience bumps in the road. When something unexpected happens, such as a cyber incident, it can be difficult to know how to react. Naturally, you will want to resolve the problem as quickly as possible so you can resume business as normal.
For these reasons, the NCSC has created the Small Business Guide to Response and Recovery. It provides small to medium sized organisations with guidance about how to prepare their response, and plan their recovery to a cyber incident. It's a companion piece to our guidance on how to protect yourself from cyber attacks.
If you're a larger business, or face a greater impact from a cyber incident, then the Incident Management section in 10 Steps to Cyber Security can further help your cyber response. Board members should refer to our guidance on planning your response to cyber incidents.
What is an incident?
The NCSC define a cyber incident as unauthorised access (or attempted access) to a organisation's IT systems. These may be malicious attacks (such as denial of service attacks, malware infection, ransomware or phishing attacks), or could be accidental incidents (such as damage from fire/flood/theft).
Reporting incidents
If you are a business, charity or other organisation which is currently suffering a live cyber attack (in progress), call 0300 123 2040 immediately. This service is available 24 hours a day, 7 days a week. Your call will be dealt with as a priority and your live incident will be triaged over the phone. Your incident will then be passed onto the Report Fraud Analysis Service who will review your report and conduct a range of enquiries, it may then get passed to the relevant law enforcement agency. You will be kept informed of the status of your report. If your organisation has been the victim of a significant cyber attack, the NCSC recommends that you start by reporting the incident to us.
If your organisation has been the victim of a significant cyber attack, the NCSC recommends that you start by reporting the incident to us.
Free cyber security toolkit
Our free Cyber Action Toolkit helps sole traders and small businesses take simple steps to protect against cyber criminals.
