Incident Response Planning for Organizations Without a Large SOC

A framework that fits small teams

NIST SP 800-61 Rev. 3 treats incident response as part of overall cybersecurity risk management, organized around the NIST Cybersecurity Framework 2.0 functions: govern, identify, protect, detect, respond and recover. For a small team, the practical message is that preparation, the plan, the contacts and the practice done in advance, decides how the first hours of a real incident go.

Roles and authority

Write down in advance who may disconnect a system, suspend an account or shut down a site without waiting for a meeting.

Severity levels

Define three or four levels based on impact on operations, data and reputation. Each level sets who is notified, how quickly and how often updates are given.

First-hour playbooks

Compromised email account

• Reset the password, revoke sessions and check registered MFA methods.
• Remove malicious inbox rules, forwarding and connected applications.
• Find phishing messages sent from the account and warn recipients.
• Assess what data was accessible.

Ransomware

• Disconnect affected devices from the network, following your responders' guidance on whether to keep them powered on.
• Disable accounts that appear compromised and protect backup systems.
• Call your incident response provider and notify your cyber insurer as the policy requires.
• Determine scope before restoring, then restore from clean backups.
• Leave any decision about ransom demands to executives with legal advice.

Lost or stolen device

• Lock or wipe the device remotely and confirm it was encrypted.
• Revoke sessions and tokens for its user.
• Assess what data was stored or accessible.

Data exposed by mistake

• Remove the public link or incorrect sharing.
• Check access logs to see who opened the data.
• Assess whether personal data was involved.

Fraudulent payment

• Contact your bank immediately to try to stop or recall the transfer.
• Preserve the emails and report the fraud to law enforcement, such as the PNP Anti-Cybercrime Group or the NBI Cybercrime Division.

Preserve evidence

• Extend log retention as soon as an incident is suspected.
• Capture snapshots or disk images before rebuilding systems where possible.
• Record every action with a timestamp and who performed it.
• Store evidence securely with a record of who handled it.

Arrange outside help before you need it

• An incident response retainer with agreed response times.
• Clear responsibilities for your managed service provider during incidents.
• Your cyber insurer's notification rules and any approved providers.
• Legal counsel familiar with data privacy obligations.
• An offline copy of all contact details.

Communication

• Prepare holding statements for staff and customers in advance.
• Share facts, avoid speculation and give a time for the next update.
• Use an alternative channel, such as a phone tree or separate messaging, if email may be compromised.

Legal and regulatory obligations

The Data Privacy Act requires personal information controllers to designate a data protection officer, who belongs in the incident team. Under the National Privacy Commission's breach management rules, when a breach involves sensitive personal information or information that could enable identity fraud, the data is reasonably believed to have been acquired by an unauthorized person, and there is a real risk of serious harm, the Commission and affected individuals must be notified within 72 hours of knowledge of the breach. Sector regulators may impose their own reporting rules. Seek legal advice on specific cases.

Practice and improve

• Run tabletop exercises based on realistic scenarios at least once a year.
• Test that contact lists and escalation paths still work.
• After every incident or exercise, record lessons learned and update the plan.