An encrypted file on a single laptop might seem like a local problem. Until employees can no longer open email, customers are no longer being served, and schedules grind to a halt. With this example of a cyberattack recovery plan for your business, you determine in advance who takes action, which systems take priority, and when you can safely restart. That provides peace of mind when every minute counts.
A recovery plan is not a thick document that disappears into a folder. It is a practical playbook for the first hours, days, and weeks after an incident. This is especially relevant for SMEs: often, there are few people who have a complete overview of both the business processes and the technology.
What should a recovery plan after a cyberattack contain?
A usable plan consistently answers the same questions: what happened, who makes decisions, how do we limit the damage, which services need to be restored first, and how do we inform those involved? Also record contact details that can be reached without your normal systems, such as phone numbers for management, the IT partner, the insurer, legal advisor, and key suppliers.
Additionally, distinguish between a security incident and a business crisis. A suspicious email reported in time requires a different approach than ransomware that encrypts files on a server. Nevertheless, every scenario begins with the same discipline: don't gamble, preserve evidence, and stop the spread first.
Assign clear roles in advance
In a small company, one person can hold multiple roles. This is not a problem, as long as everyone knows who is responsible for what. Appoint at least an incident coordinator who records decisions, a technical point of contact who secures systems, and a communications officer for employees and customers.
The owner or management decides on major business decisions, such as temporarily suspending a service or engaging external experts. Do not let technical measures depend on a group chat where everyone responds at the same time. A clear line of command prevents delays and conflicting actions.
Example corporate cyberattack recovery plan: the first hours
You can adapt the scenario below to your own environment. It assumes an employee receives a notification that shared files can no longer be opened and a ransom message appears.
1. Isolate, but do not erase
Immediately disconnect the affected computer from the network and Wi-Fi. Do not simply turn it off unless advised by a specialist. Information in RAM and log files can help determine the cause and extent of the incident later.
Where necessary, block affected user accounts, delete active sessions, and temporarily disable connections to other systems. This includes remote access, synchronizations, and shared network drives. The goal is not to fix everything immediately, but to prevent the attack from spreading further.
Report the incident immediately to the designated incident coordinator and note the times, error messages, involved devices, and employee observations. Take photos of screen messages if it is safe to do so. A simple incident log will be of great value later on.
2. Determine which business processes are affected
Next, map out what still works. Can employees still make calls? Is customer data available? Is the website, the digital workplace, the accounting system, or the point-of-sale system working? Do not look only at the technology, but also at the practical consequences for customers and employees.
Work with priorities. For an installation company, accessibility and access to the schedule may be most important. For a healthcare or administrative organization, file availability and confidentiality carry more weight. A webshop will primarily want to restore orders, payments, and customer communication quickly.
Note downtime is acceptable for each crucial process. Sometimes four hours without a system is annoying but manageable, whereas a day without telephony or access to client appointments causes immediate damage. This prevents repair work from being driven by whoever shouts the loudest.
3. Call in expert help
Ransomware, account abuse, and potential data breaches require technical analysis. An ICT partner can examine log files, secure access, identify the attack vector, and assess whether other systems have been affected. That party can also assist with a controlled recovery from a clean environment.
If you have a policy, contact your cyber insurer before carrying out major remediation actions. Many insurers have established procedures and specialists. Furthermore, in the event of a suspected data breach, you must assess whether notification to the Dutch Data Protection Authority is required. This depends on the personal data involved, the risks to individuals, and the measures taken.
Recover without reversing the attack
The biggest mistake after an incident is restoring too quickly. A backup is only usable when you know it is clean, complete, and accessible. Therefore, first check when the attack presumably started. A backup from yesterday may still contain infected files or an already compromised configuration.
Preferably restore in this order: first identity and access control, then the network foundation, and finally the most critical applications and data. Change passwords for administrator accounts, check additional access security, and remove unknown users, devices, and forwarding rules. Only then does it make sense to grant employees access again.
Test restored systems on a limited basis first. Check if files open, applications work correctly, and data is complete. Also check connections with printers, telephony, websites, accounting software, and external suppliers. A technical online system is not automatically usable for your daily work yet.
Communicate honestly and practically
Employees need clear instructions during an incident. Explain which systems must not be used, where they can ask questions, and how to report suspicious messages. Do not ask them to restore files themselves or share passwords via email.
Customers do not need to know all the technical details, but they do need to know what the outage means for them. Explain which service is temporarily unavailable, what alternative contact method is available, and when you will provide the next update. Only make promises regarding recovery times if you can substantiate them.
In the event of a potential data breach, carefulness is essential. Communicate factually: which data may be involved, what are you doing to mitigate risks, and what steps can affected parties take themselves? Do not fill in unknown facts. Transparency only works if the information is accurate.
After recovery: examine, improve and exercise
Once all systems are up and running again, the pressure is often gone. It is precisely then that you must set aside time for evaluation. Investigate how the attack gained entry: via a stolen password, incorrectly configured remote access, a vulnerable application, or human error. Without the cause, you primarily address the consequences.
Document improvement actions with an owner and deadline. Consider better access control, security updates, separate administrator accounts, additional monitoring, employee training, and a backup strategy that you can demonstrably restore. Store backups separately from your daily environment and regularly test whether recovery is successful.
You also need to practice a recovery plan. This doesn't always have to involve an extensive crisis drill. For example, discuss a scenario every quarter: what do we do if an employee loses their Microsoft 365 account, the internet connection fails, or a server becomes unavailable? This way, you discover missing contact details, unclear responsibilities, and dependencies before any damage occurs.
For many SMEs, external guidance in this regard is wise. Cloudformatie can help set up your workstations, network, email, and backups in a manageable way, so that you do not have to figure out where your digital dependencies lie during an incident.
A good recovery plan does not promise that nothing will ever go wrong. However, it does ensure that you act calmly, demonstrably, and with the right priorities after an attack. Therefore, schedule an hour with the people you need, go through this example, and set the first appointments today.