First Hour After a Breach: Incident Response Plan Template, Runbook, Contact Sheet, Log and Tabletop Exercise (UK Small Business)

Product details

For UK small businesses, with or without an IT provider. When something goes wrong, people need to know who does what and who to call. This kit gives a small business an incident response plan for the first hour, worked out in advance.

It covers four kinds of incident: an account taken over, ransomware or malware, a lost or stolen device, and invoice or payment fraud. Each one has its own decision steps. If personal data is involved, the runbook walks you through the ICO's 72-hour decision.

It's based on UK guidance from the NCSC, the ICO, Report Fraud (formerly Action Fraud), the Payment Systems Regulator and UK Finance's Take Five campaign. A sources list lets you check it yourself.

£29 · digital download (ZIP file).

What's inside

• Start here guide (PDF): how to set the kit up before you need it
• First-hour runbook (PDF): five first moves for any incident, then decision steps for each incident type and for the 72-hour decision. It ends with a who-to-tell table and short scripts for staff, customers and suppliers
• Emergency contact sheet (editable Word document): your incident roles and providers, with the UK reporting numbers filled in
• Incident log and timeline workbook (Excel): a timeline of what happened and who decided what, and why. It works out the 72-hour point for you and keeps payment details and reference numbers together
• Tabletop exercise (PDF): three practice scenarios with a facilitator sheet and debrief page.

How it works

1. Click Get My Kit and check out. You'll receive a download link after payment.
2. Open the Start here guide and set the kit up before you need it, starting with the contact sheet.
3. Practise with your team using one of the tabletop scenarios.
4. If something happens, follow the runbook and keep the incident log as you go.

It's self-serve. You set it up yourself, with no calls or meetings with us.

What it isn't

Secordit Intelligence isn't an incident-response provider, a bank, an insurer or a law firm. The kit can't recover money or data, or investigate an attack. Your bank decides about money. Report Fraud, or Police Scotland in Scotland, takes crime reports. The ICO takes personal data breach reports, and your insurer or broker answers questions about cover.

General information, not legal advice.

FAQ

Do we have to report every breach to the ICO?
No. The ICO says: "You do not need to report every breach to the ICO." You report where a risk to people is likely. Either way, you record every breach.

Will it help us get money back after invoice fraud?
It tells you to call your bank straight away, and explains the PSR's reimbursement protections for some bank transfers. They cover individuals, microenterprises and charities, so not every business qualifies. Whether any money comes back is your bank's decision.

We have an IT provider. Is this still useful?
Yes. The runbook tells you when to call them, and covers the parts that are the business's job: the bank, reporting, the ICO decision, staff and customers.

What format are the files?
PDF, Word (.docx) and Excel (.xlsx). The workbook has been tested in LibreOffice Calc. It should also open in Excel and Google Sheets.

Who's behind it

Secordit Intelligence was set up in February 2026 by Matthew Protheroe-Hill, its director. Before that, he co-founded Sencode Cyber Security and was a director there from 2019 to 2023. Qualification: BSc (Hons) Cyber Security & Networks (1st Class), Teesside University.

Everything in the download

A ZIP with 5 files: the Start here guide (PDF), the first-hour runbook (PDF), the emergency contact sheet (Word), the incident log and timeline workbook (Excel) and the tabletop exercise (PDF).

The problem it helps with

When something goes wrong, people need to know who does what and who to call. This kit lets a small business work that out in advance, and practise it.

Compared with paying for help

You'd rather have a plan in place before something goes wrong than work it out in the middle of it. A specialist firm or an IT consultant can write an incident response plan with you, and they charge for their time. This kit lets you set the plan up yourself and practise it. It's a set of templates, not a like-for-like swap for paid help.

Delivery

Digital download (ZIP file). You'll receive a download link after payment.

Ready to start? Use the Get My Kit button under the price at the top of this page.

Secordit Intelligence's own product. Not made, checked or endorsed by the NCSC, the ICO, GOV.UK, Report Fraud, Police Scotland, the PSR, UK Finance or Take Five. Contains public sector information licensed under the Open Government Licence v3.0: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/