Say your bookkeeper has just paid a fake invoice. Someone has to ring the bank. Someone else has to decide whether the ICO needs to know.
The middle of an incident is a hard time to work out who does what. It's easier when the answers are already written down, and your team has tried them once in practice.
The runbook covers four kinds of incident: an account taken over, ransomware or malware, a lost or stolen device, and invoice or payment fraud. Each one has its own decision steps. If personal data is involved, it walks you through the ICO's 72-hour decision.
It's written for UK small businesses, with or without an IT provider. The steps draw on UK guidance from the NCSC, the ICO, Report Fraud, the Payment Systems Regulator and UK Finance's Take Five campaign. A sources list names each one.
£29 · digital download (ZIP file).
Four steps, done in advance
- Click Get the kit and check out. You'll receive a download link after payment.
- Open the Start here guide and set the kit up, starting with the contact sheet.
- Practise with your team using one of the tabletop scenarios.
- If something happens, follow the runbook and keep the incident log as you go.
You set it up yourself. There are no calls or meetings with us.
What's inside
- Start here guide (PDF): how to set the kit up before you need it
- First-hour runbook (PDF): five first moves for any incident, then decision steps for each incident type and for the 72-hour decision. It ends with a who-to-tell table and short scripts for staff, customers and suppliers
- Emergency contact sheet (editable Word document): your incident roles and providers, with the UK reporting numbers filled in
- Incident log and timeline workbook (Excel): a timeline of what happened and who decided what, and why. It works out the 72-hour point for you and keeps payment details and reference numbers together
- Tabletop exercise (PDF): three practice scenarios with a facilitator sheet and debrief page.
What it isn't
Secordit Intelligence isn't an incident-response provider, a bank, an insurer or a law firm. The kit can't recover money or data, or investigate an attack. Your bank decides about money. Report Fraud, or Police Scotland in Scotland, takes crime reports. The ICO takes personal data breach reports, and your insurer or broker answers questions about cover.
Want someone to write the incident response plan with you? A specialist firm or an IT consultant can do that.
General information, not legal advice.
FAQ
Do we have to report every breach to the ICO?
No. The ICO says: "You do not need to report every breach to the ICO." You report where a risk to people is likely. Either way, you record every breach.
Will it help us get money back after invoice fraud?
It tells you to call your bank without delay, and explains the PSR's reimbursement protections for some bank transfers. They cover individuals, microenterprises and charities, so not every business qualifies. Whether any money comes back is your bank's decision.
We have an IT provider. Is this still useful?
Yes. The runbook tells you when to call them, and covers the parts that are the business's job: the bank, reporting, the ICO decision, staff and customers.
What format are the files?
PDF, Word (.docx) and Excel (.xlsx). The workbook has been tested in LibreOffice Calc. It should also open in Excel and Google Sheets.
Who wrote it
Secordit Intelligence was set up in February 2026 by Matthew Protheroe-Hill, its director. Before that, he co-founded Sencode Cyber Security and was a director there from 2019 to 2023. Qualification: BSc (Hons) Cyber Security & Networks (1st Class), Teesside University.
Everything in the download
A ZIP with 5 files: the Start here guide (PDF), the first-hour runbook (PDF), the emergency contact sheet (Word), the incident log and timeline workbook (Excel) and the tabletop exercise (PDF).
Delivery
Digital download (ZIP file). You'll receive a download link after payment.
Start with the emergency contact sheet, while nothing is going wrong.
Secordit Intelligence's own product. Not made, checked or endorsed by the NCSC, the ICO, GOV.UK, Report Fraud, Police Scotland, the PSR, UK Finance or Take Five. Contains public sector information licensed under the Open Government Licence v3.0: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/