A cyberattack has hit you. Now what?
For most Melbourne businesses, the honest answer is: they don’t know. There’s no documented process, no designated response team, and no clear steps to follow. And that gap costs real money. According to Australia’s Annual Cyber Threat Report 2024-25, the average self-reported cost of a cybercrime incident for small businesses rose by 14% to an average of $56,600, while medium-sized businesses saw costs jump 55% to an average of $97,200.
A cyber incident response plan for your Melbourne business is no longer a nice-to-have. In 2026, it’s the difference between a managed recovery and a full-blown crisis. This guide walks you through exactly what a response plan is, how to build one, and what to do when things go wrong.
What Is a Cyber Incident Response Plan?
A cyber incident response plan is a documented set of instructions that tells your team exactly what to do when a security incident occurs. Think of it as your cybersecurity fire drill, written down, assigned to specific people, and ready to action at a moment’s notice.
It covers everything from who gets called first to how you notify clients, how you isolate affected systems, and how you get back online. Without one, you’re improvising in the middle of a crisis, which rarely ends well.
A solid plan typically includes:
- Defined roles and responsibilities so everyone knows their part
- Response procedures for different types of incidents, from phishing to ransomware
- Contact lists for internal stakeholders, external stakeholders, legal, and your IT provider
- Communication templates for notifying clients and regulators
- Recovery steps to restore operations safely
- A post-incident review process so you learn from what happened
The goal isn’t to prevent every attack. No plan can do that. The goal is to make sure your business can respond quickly, limit the damage, and recover faster than if you had no plan at all.
For Melbourne businesses, this matters even more. The ACSC’s hotline fielded 42,500 calls over the 2024-25 reporting period, a 16% year-on-year increase, averaging 116 calls per day. Cyber threats are not slowing down, and local businesses are firmly in the crosshairs.
The 6 Phases of an Effective Incident Response Plan
The most widely referenced framework for effective incident response comes from NIST, the National Institute of Standards and Technology. The SANS Institute’s six-step model is widely recognised in cybersecurity training and operations, covering: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
Here’s how each of the phases of incident response works in practice:
| Phase | What It Involves |
|---|---|
| 1. Preparation | Building your response team, documenting policies and procedures, training staff, and setting up tools like SIEM |
| 2. Identification | Detecting the incident, assessing the severity of the incident, and confirming whether a real threat exists |
| 3. Containment | Isolating affected systems to stop the breach from spreading further |
| 4. Eradication | Removing malware, revoking compromised credentials, and patching the vulnerability that was exploited |
| 5. Recovery | Restoring systems and data, verifying integrity, and returning to normal business operations |
| 6. Lessons Learned | Reviewing what happened, updating your response playbook, and communicating finding with your incident response team |
The preparation phase is where most Melbourne businesses fall short. It’s hard to prioritise building a plan when nothing has gone wrong yet. But that’s exactly when you need to build it.
Australia’s 2024 Commonwealth Cyber Security Posture Report noted that only 86% of surveyed entities had an incident response plan in place, up from 82% in 2023, and recommended that entities maintain an incident response plan and exercise it at least every two years. For private businesses, the numbers are likely lower.
What to Include in Your Melbourne Business’s Incident Response Plan
A good IT incident response plan for a small business doesn’t need to be a 100-page document. It needs to be clear, practical, and tailored to your actual business needs. Here’s what to include:
1. Incident Classification
Define what counts as a security incident in your organisation. Not every alert is a crisis. Set up tiers based on the potential impact so your response team knows when to escalate.
2. Roles and Responsibilities
Who leads the response? Who communicates with clients? Who contacts your managed IT provider? Assign names, not just job titles. Include backup contacts for each role.
3. Communication Plan
Document how you will notify internal stakeholders and external stakeholders, including clients, suppliers, your legal team, and regulators. Under Australia’s Privacy Act, if customer data has been compromised, notification obligations kick in quickly.
4. Containment and Isolation Steps
Detail exactly how your team should isolate affected systems. This might mean disconnecting a device from the network, disabling remote network access, or taking a server offline. Speed here limits the damage significantly.
5. Evidence Preservation:
Before you start cleaning up, document everything. Screenshots, logs, timestamps. This matters for insurance claims, legal proceedings, and your post-incident review.
6. Recovery Procedures:
How do you restore data from backups? In what order do you bring systems back online? Who verifies that systems are clean before they go live again?
7. Regulatory Notification Requirements
On 30 May 2025, the Australian Government introduced a mandatory ransomware reporting regime for businesses with annual turnovers of $3 million or more. Know your compliance obligations before an incident happens, not during one.
8. A Response Playbook for Common Threats
Create specific playbooks for the most common scenarios: phishing, ransomware attacks, insider threats, and data breaches. Each should have step-by-step response steps, so your team doesn’t have to think too hard under pressure.
A managed IT provider or ICT consulting partner can help Melbourne businesses build these documents with the right level of technical detail.
Real-World Example: What Happens When a Melbourne SMB Has No Plan
Here’s a scenario that plays out in Melbourne more often than most business owners realise.
A small professional services firm gets hit with a ransomware attack on a Thursday afternoon. Someone on the team clicked a phishing link in an email that looked like it came from their accounting software. The malware spreads through the network overnight, encrypting files on connected devices by Friday morning.
Without a cyber incident response plan, here’s what typically happens:
- Nobody knows who to call first. The IT person is on leave. Someone Googles “what to do after a cyberattack” while files are still being encrypted.
- Affected systems stay connected. Because there’s no procedure to isolate them, the ransomware keeps spreading.
- Evidence gets destroyed. In a panic, someone restarts machines, overwriting logs that could have identified the threat actor and entry point.
- Clients aren’t notified in time. The business isn’t sure if client data was compromised, so they wait, potentially breaching their obligations under the Privacy Act.
- Recovery takes weeks. Without clean backups and a tested recovery plan, the business is trying to rebuild from scratch.
- The business has to decide whether to pay a ransom. With no alternative and no backups, some do.
Now compare that to a business that has a documented security incident response plan. Within the first hour, they’ve isolated affected systems, notified their managed IT provider, flagged the incident to the ACSC, and sent their legal team a heads-up. Recovery starts from verified clean backups. Clients are notified within 24 hours. The whole thing is resolved in days, not weeks.
The plan doesn’t make the attack less painful. It just means you spend less time figuring out what to do and more time actually doing it.
How Often Should You Update Your Incident Response Plan?
Building a plan and filing it away is not the same as having a working plan. Cyber threats evolve constantly, and your response procedures need to keep pace.
Here’s a practical update schedule for Melbourne businesses:
| Trigger | What to Review |
|---|---|
| Annually | Full review of the entire plan, roles, contacts, and tools |
| After any security incident | Update based on lessons learned from what actually happened |
| After staff changes | Update roles and responsibilities, contact lists |
| After major IT changes | New systems, cloud migrations, or significant software updates |
| After a regulatory update | Changes to Australian data privacy regulations or compliance obligations |
Australia’s 2025 Commonwealth Cyber Security Posture Report showed 90% of entities now have an incident response plan, up from 86%, but ongoing improvement remains a priority with the recommendation to increase cyber security incident reporting and maintain a regularly tested incident response plan.
Testing matters as much as updating. A tabletop exercise, where your team walks through a simulated cyberattack scenario, is one of the best ways to find gaps in your plan before a real incident exposes them. ACSC recommends exercising your plan at least every two years. For most Melbourne businesses, annual testing is a more realistic and sensible cadence.
You should also make sure your firewall services and monitoring tools are reviewed at the same time. A response plan is only as good as the security measures underpinning it.
How Telco ICT Group Supports Incident Response in Melbourne
Building a cyber incident response plan from scratch takes time, technical knowledge, and an honest assessment of your current vulnerabilities. For most Melbourne businesses, that’s not something that happens on the side of running a business.
Telco ICT Group works with Melbourne organisations to:
- Assess your current security posture through a risk assessment of your systems, policies, and procedures
- Build a practical, tailored incident response plan that reflects your actual business operations, not a generic template
- Set up monitoring infrastructure using security information and event management (SIEM) tools to alert your team to suspicious activity before it escalates
- Provide 24/7 managed IT support so there’s always someone on call when something goes wrong
- Run tabletop exercises to test your team’s response capabilities and identify gaps in your existing plan
- Help you stay across regulatory requirements, including the Privacy Act, the 2024 Cyber Security Act, and ACSC guidance
Developing an incident response plan is not a one-off project. It’s an ongoing commitment to protecting your business, your clients, and your data. Telco ICT Group makes that process manageable for Melbourne businesses of all sizes.
Explore our Managed IT services or speak to one of our team members today.
Frequently Asked Questions
Is a cyber incident response plan required by law in Australia?
Under the mandatory ransomware reporting regime introduced on 30 May 2025, businesses with annual turnovers of $3 million or more must report ransomware payments. A formal plan isn’t mandated for all SMBs, but it’s essential if you hold customer data under the Privacy Act.
How long does it take to build an incident response plan?
A basic plan can be drafted in two to four weeks. A comprehensive plan with tabletop testing typically takes four to eight weeks, especially with professional assistance.
What is the ACSC’s role when my business is attacked?
The Australian Cyber Security Centre provides guidance, threat intelligence, and incident response assistance to businesses across Australia. You can report cyber incidents at cyber.gov.au or call 1300 CYBER1 (1300 292 371).
What types of incidents should my plan cover?
Your plan should cover phishing, ransomware, data breaches, insider threats, and denial-of-service attacks at a minimum. Each should have its own response playbook with clear steps for your team to follow.
How do I know if my incident response plan is actually working?
The only way to know is to test it. Run a tabletop exercise at least once a year where your team walks through a simulated attack scenario. Any gaps you find in the exercise are far cheaper to fix than finding them during a real incident.
Table of contents
Related Posts
We’ll handle the tech
so you can get on with
running your business.
