Incident Response: Security Incident Playbook for SMBs

NIST describes how incidents have changed: they are more frequent and cause more damage, and recovery often takes weeks or months. Incident handling therefore belongs in overall risk management (SP 800-61 Rev. 3, Section 2.1). Playbooks provide actionable steps for typical situations; documented procedures can be practiced and help onboard new people (Section 2.3).

This playbook is a TOMORIS recommendation for the general process for any type of security incident. Immediate measures for ransomware, the emergency manual for recovery and the form for the NIS2 notification are in separate downloads.

Rev. 3 maps incident handling to the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify and Protect prepare, while Detect, Respond and Recover are the actual handling; findings flow back continuously through the Improvement category. NIST expressly leaves it to each organization to use the model that suits it. This playbook uses the familiar phases and lists the identifiers from Rev. 3.

1. 1

   Receive and review the report

   Reports come in through fixed, trusted channels (DER.2.1.A9), including from third parties (NIST RS.MA-02). Briefly check whether a security incident has actually occurred and estimate severity and urgency (NIST RS.MA-02).

2. 2

   Declare the incident, appoint a lead

   If the defined criteria are met, declare the incident and appoint a responsible person; if needed, call in the IR service provider and trigger other plans such as the contingency plan (NIST DE.AE-08, RS.MA-01).

3. 3

   Classify and prioritize

   Determine the type of incident, such as data exfiltration, ransomware, account takeover or service outage, and classify and prioritize it using a consistent method (NIST RS.MA-03, DER.2.1.A11).

4. 4

   Log and secure evidence

   Record every finding and action with a timestamp, keep records confidential and unaltered; secure data that can explain the type and cause (NIST RS.AN-06, RS.AN-07; DER.2.1.A6, A16).

5. 5

   Contain

   Isolate affected systems and network segments, block unauthorized access, change passwords, keys and service accounts if compromise is suspected, revoke privileged access (CISA playbook, Containment). Weigh the impact on operations and on evidence preservation.

6. 6

   Determine extent and cause

   Reconstruct the sequence of events, identify vulnerabilities and attack paths, and search for traces and backdoors even on systems that are not obviously affected (NIST RS.AN-03, RS.AN-08). New traces expand the analysis and containment (CISA playbook).

7. 7

   Eradicate

   Identify all affected systems and services, remove malware, disable compromised accounts, close exploited vulnerabilities (NIST RS.MI-02); have the head of IT operations approve the measures beforehand (DER.2.1.A5).

8. 8

   Recover and confirm

   Check backups for integrity before use (NIST RC.RP-03), restore systems with all patches, change all credentials, involve users in functional tests and then monitor closely (DER.2.1.A6). Declare the end of the incident based on criteria (NIST RC.RP-06).

Do not tip off the attacker: CISA advises informing affected parties by phone rather than email, using a channel outside the potentially compromised systems for coordination and not uploading malware samples to public analysis services.

Under § 35 para. 1 NISG 2026, an incident is significant if it has caused or is capable of causing severe operational disruption or financial loss for the entity, or has affected or is capable of affecting others by causing considerable material or non-material damage; the NISV 2026 (Austrian NIS Regulation 2026) sets out further criteria. The GDPR notification is only waived if the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Check both obligations in parallel and early. The fields and process of the NIS2 notification are in the “NIS2 incident report” template, and the obligations are in the “NIS2 reporting obligations” guide.

• Final report prepared: incident, handling and recovery measures, lessons learned (NIST RC.RP-06).
• Evaluated: how quickly was the incident detected and resolved, did the reporting channels work, was the information sufficient, were detection and measures effective (DER.2.1.A17)?
• Everyone involved has reported their experiences; processes and procedures adjusted (DER.2.1.A18).
• Cause eliminated, vulnerabilities in infrastructure and processes recorded, roles and authorities clarified, training needs and tools improved (CISA, Post-Incident).
• Detection sharpened: rules and logging for the observed attack techniques added, blind spots closed (CISA, Post-Incident).
• Executive management informed: annually about all incidents, immediately if urgent action is needed (DER.2.1.A17).
• Instructions for comparable incidents created and communicated (DER.2.1.A17).
• Escalation paths tested in exercises (DER.2.1.A14), and tabletop exercises for increased protection needs (A22); lessons from exercises incorporated (NIST ID.IM-02).
• Playbook and contacts reviewed and updated regularly (DER.2.1.A7, NIST ID.IM-04).