In this guide · 8 sections
- 01What an incident response plan needs to cover
- 02Page 1: roles and the contact tree
- 03Page 2: first actions for the most likely incidents
- 04PDPA: when a breach must be reported to PDPC
- 05Evidence to keep during a cyber incident
- 06Test the plan once a year with a tabletop exercise
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
A small business plan fits on two pages: roles and a contact tree (CSA Cyber Incident Helpline 6890 9555, police, bank, insurer, IT support, PDPC), then first actions for your likeliest incidents. Print it, keep it offline and rehearse it yearly.
What an incident response plan needs to cover
Large frameworks describe six phases: preparation, detection, containment, eradication, recovery and lessons learned. A small business needs the same logic in plain words: who is in charge, who to call, what to do in the first hour, what to keep as evidence, and how to recover.
| Page | Section | What goes in it |
|---|---|---|
| 1 | Roles | Incident lead, deputy, IT contact, communications person, who can approve spending |
| 1 | Contact tree | Phone numbers for helpline, police, bank, insurer, IT support, accountant, lawyer, PDPC |
| 1 | Key accounts | Where admin logins and backups are, and who holds the break-glass account |
| 2 | First actions by scenario | 5 to 8 steps each for your most likely incidents |
| 2 | Evidence and log | What to preserve and a simple timeline template |
| 2 | After the incident | Review meeting, fixes, plan update |
Page 1: roles and the contact tree
Write names and mobile numbers, not job titles alone. In a five-person company, one person may hold several roles; that is fine as long as it is written down.
- Incident lead: decides on shutting systems down, paying for help and notifying regulators. Usually a director.
- Deputy: takes over if the lead is unreachable or on leave.
- IT contact: internal person or outside provider who can reset accounts, isolate devices and restore backups.
- Communications: speaks to staff, customers and, if needed, media. One voice only.
| Who | When | Contact |
|---|---|---|
| CSA Cyber Incident Helpline | Suspected or active cyber incident; triage and referrals | 6890 9555 (Mon to Fri, 8am to 6pm) or cyberresilience.sg |
| Police | Crime: fraud, extortion, ransomware, hacking | 999 for emergencies; online police report otherwise |
| ScamShield Helpline | Unsure whether something is a scam | 1799 (24/7) |
| Your bank | Any unauthorised or fraudulent payment | 24-hour fraud line from the bank's website |
| Cyber insurer | Before engaging paid responders, if you have cover | Policy's incident hotline |
| PDPC | Notifiable personal data breach | Online data breach notification form |
| IT support, accountant, lawyer | Recovery, financial and legal advice | Names and mobile numbers |
The CSA helpline was announced on 14 October 2026 and is run by the Cyber Resilience Centre (CSA press release). Our Cyber Incident Helpline guide explains what it does and what to have ready. CSA's SingCERT also publishes CyberAid guides for common incidents.
Page 2: first actions for the most likely incidents
Pick the four or five scenarios most likely for your business and write the first steps for each. Keep each to a few lines; detail lives in the linked guides.
Business email account taken over
Reset the password from a clean device, sign out all sessions, check and remove forwarding rules and unknown MFA methods, warn contacts if fraudulent emails were sent, and check whether any invoices were altered. Full steps are in our hacked business email guide.
Ransomware or encrypted files
Disconnect affected computers from the network (unplug or turn off Wi-Fi) but do not wipe them, disconnect backup drives, call your IT contact and the helpline, report to the police, and do not contact the attackers before taking advice. See our ransomware response guide.
Fraudulent payment or changed bank details
Call your bank's fraud line immediately to try to stop or recall the payment, then make a police report. Confirm any bank detail changes with the supplier by phone using a number you already had.
Lost or stolen laptop or phone
Remotely lock or wipe it, reset the user's passwords and sessions, note whether it was encrypted and what data it held, and report theft to the police.
Personal data sent to the wrong person or exposed
Ask the recipient to delete it and confirm in writing, remove public exposure, then assess whether the breach is notifiable to PDPC (below).
PDPA: when a breach must be reported to PDPC
Under the PDPA, a data breach must be notified to the PDPC if it is likely to cause significant harm to affected individuals or affects 500 or more people. The PDPC's guide on managing and notifying data breaches expects you to assess a suspected breach within 30 calendar days, and to notify the PDPC no later than 3 calendar days after deciding it is notifiable. Where significant harm is likely, affected individuals must be told too.
Evidence to keep during a cyber incident
Investigators, insurers and the PDPC all ask what happened and when. Evidence disappears quickly if you start wiping and resetting without recording first.
Evidence checklist
Test the plan once a year with a tabletop exercise
A tabletop exercise is a one-hour meeting where you talk through a made-up incident using the plan. No systems are touched. It shows quickly whether numbers are wrong, roles unclear or backups untested.
Pick a realistic scenario
For example: the finance mailbox is taken over and a customer receives a fake invoice with new bank details.
Gather the people named in the plan
Incident lead, deputy, IT contact and whoever handles finance and communications.
Walk through the first hour
Ask: who notices, who is called, what is done first, which number is dialled. Use the printed plan only.
Add a twist halfway
The lead is overseas, or the backups turn out to be a week old. See how the plan copes.
Fix what you found within a month
Update numbers, roles and steps, test a backup restore, and date the new version of the plan.
Check whether your cyber insurance policy requires you to call its hotline first; our cyber insurance guide explains common conditions.
Do it yourself or get help?
Most small businesses can fill in this template in an afternoon. The value comes from accurate contact details, a printed copy outside your systems and one rehearsal a year.
Our Incident & Ransomware Response Plan (S$390) writes the plan for your systems and contacts, checks your backups and admin access, and runs a first tabletop exercise with your team.
Frequently asked questions
Yes, but a short one. Most small-business incidents are email takeovers, payment fraud, ransomware and lost devices, and the first hour decides the damage. A two-page plan with named roles, phone numbers and first steps means people act quickly instead of searching for numbers while the problem spreads.
Call your IT support and, for triage and advice, CSA's Cyber Incident Helpline on 6890 9555 during office hours. Report crimes such as fraud, extortion and ransomware to the police, call your bank immediately about any fraudulent payment, inform your cyber insurer if you have one, and assess whether PDPC must be notified.
The PDPC expects a suspected breach to be assessed within 30 calendar days. If it is notifiable, because it is likely to cause significant harm or affects 500 or more people, you must notify the PDPC no later than 3 calendar days after deciding that. Affected individuals must also be told if significant harm is likely.
Keep a printed copy in the office and at the incident lead's home, plus a copy outside your main systems, such as on a phone. During ransomware or an account takeover, your shared drive and email may be unavailable or controlled by the attacker, so a plan stored only there may be useless.
Review it at least once a year with a tabletop exercise, and whenever key people, IT providers, banks or insurers change. After any real incident, hold a short review and update the plan with what you learned. Date each version so everyone knows which copy is current.