During an incident, every minute counts, and it is the worst time to improvise. That is why developing an incident response plan is the first of the 13 baseline controls recommended by the Canadian Centre for Cyber Security.
What a plan is for
- Limit damage by acting quickly and in the right order.
- Restore operations faster, from tested backups.
- Meet your obligations, including privacy breach rules.
- Protect your reputation with clear, controlled communication.
- Reassure clients and insurers, who increasingly expect you to be prepared.
What an SMB plan should contain
A useful plan fits in a few pages:
- Roles: who decides, who coordinates, who communicates.
- Contacts: IT provider, cyber insurer, legal counsel, bank, police.
- First actions: isolate, preserve evidence, don't pay a ransom without advice, change passwords.
- Recovery: where backups are, how to restore, in what order.
- Obligations: record the incident, assess the risk of harm, notify when required.
Privacy breach obligations
Under PIPEDA, organizations must keep a record of every breach of security safeguards and report to the Office of the Privacy Commissioner of Canada, and notify individuals, when there is a real risk of significant harm. In Quebec, Law 25 requires a confidentiality incident register and notice to the Commission d'accès à l'information when there is a risk of serious injury.
Test it
A plan nobody has read is useless. A 60-minute tabletop exercise with your provider is often enough to reveal blind spots.
We help you prepare and test your plan through the Cyberallié Shield or My Cyber & AI Coach.