Call and contain
- Stop using the affected device and disconnect it from the network where safe.
- Do not switch everything off blindly or erase equipment. Follow your response lead’s instructions and prioritise physical safety.
- Use a clean, trusted device and an independent communication route.
- Restrict compromised accounts and change affected passwords from that clean device, with the response lead checking recovery access.
- Record what you saw, when you saw it and what you changed.
- Preserve relevant messages, logs and transaction details. Do not forward suspected malicious attachments to colleagues.
Decide who must be told
The ICO's breach-reporting guidance says likely risks to people's rights and freedoms must be reported without undue delay and, where feasible, within 72 hours of awareness. Read ICO breach-reporting guidance.
Start the risk assessment promptly. Do not wait for a complete technical investigation before seeking advice or making a required initial notification. Give your insurer notice through the route and timescale in your policy. If payments or banking access may be affected, contact your bank using a trusted number.
The ICO's current breach-reporting guidance directs organisations to consider Report Fraud for incidents believed to have criminal intent, and Police Scotland for organisations in Scotland. Read ICO breach-reporting guidance.
Use your data protection adviser for decisions about notifying individuals or other contractual and regulatory duties. This is general operational guidance, not legal or insurance advice.
What happens out of hours
Our security partner's analysts review the contracted account-monitoring alerts 24 hours a day, including weekends and bank holidays. The service looks for suspicious sign-ins, hidden mailbox rules and exports, and can isolate a compromised account. This does not mean every device or service has a 24 hour helpdesk or a guaranteed recovery time.
Follow the emergency route in your agreement and leave clear contact details. Normal support hours are Monday to Friday, 08:30 to 17:30, excluding UK bank holidays. Do not send passwords in a support request.
What a written incident report contains
| Record | Purpose |
|---|---|
| Timeline and affected scope | Separate observed facts from matters still being investigated |
| Detection and containment | Record alerts reviewed, access restricted and actions taken |
| Data and recovery assessment | Identify what could have been accessed and the usable recovery position |
| Notifications and evidence | Record decisions, preserved records and responsible contacts |
| Follow-up actions | Set owners for improvements and the next review |
Prepare before an incident
The NCSC's small business guide covers backups, protection of devices and accounts, and recognising scams. Read NCSC small business guide.
Agree the incident-report scope and responsibility for coordinating suppliers. Keep an independent copy of essential contacts and exercise the process with the person who can authorise spending and business decisions.
What we can do for you
We help you agree priorities, document workarounds and check the recovery arrangements. Continuity planning is quoted as a fixed fee after a free 30 minute call. The technical fallbacks use our standard prices.
| Technical fallback | From per month, plus VAT |
|---|---|
| Independent Microsoft 365 backup | £2.50 per user, included as standard in support agreements |
| Email filtering | £1.50 per user, not needed as an additional filter with Microsoft 365 Premium |
| Server backup with cloud failover | £35 per server |
| Desktop and laptop backup | £10 per device |
| Business phone system | £11 per user |
Monthly starting prices exclude VAT and use a 3 year term billed monthly. Shorter terms cost a little more. Your price and the actual fallback arrangements are confirmed in a written quote.
Questions about this service
Does a backup keep every service running?
No. Backup provides a recovery copy. Alternative access, replacement equipment, staff instructions and decisions are separate parts of a continuity plan.
Will you guarantee a recovery time?
We agree targets after reviewing the systems, dependencies and test results. A planning target or example is not a contractual recovery guarantee.
Is security monitoring an out-of-hours helpdesk?
No. Our security partner's analysts provide the contracted 24x7 account monitoring. Normal support hours are Monday to Friday, 08:30 to 17:30, excluding UK bank holidays.
Where should we start?
Call 01494 866668 for a free 30 minute planning conversation. Describe the activity you could least afford to lose and the arrangements already in place.
Free tools to help you prepare
Continuity tools
- Free business continuity plan template for small businesses
- How much does an hour of IT downtime cost your business?
- Find your single points of failure
Use these planning aids to prepare a conversation. Do not put passwords or confidential records in a worksheet.
Related information
Talk to us about your business
Prefer us to contact you? Request a call back.