Every Small Business Has an Incident-Response Plan. Most Just Call It Panic.

In 1935 a bomber fell out of the sky over Ohio and the flags went up on Australian beaches. Same year, same idea: not braver people. A piece of paper.

---

On 30 October 1935, a new bomber taxied out at Wright Field in Ohio with a crowd watching. It was more complicated than anything the Army's pilots had flown.

Four engines. A bomb bay in the belly. Gun positions along the fuselage. The Army had all but decided to buy it. The pilot was Major Ployer Peter Hill, an experienced Army test pilot, on his first flight in the type.

The aeroplane lifted off, climbed to about three hundred feet, stalled, and fell.

Most of the crew got themselves clear. A lieutenant named Robert Giovannoli went into the burning wreck twice for the pilot. Major Hill and Boeing's chief test pilot, Leslie Tower, both died of their injuries.

When the investigators went through the wreckage they found no fault with the engines, the wings, or the design. They found a lock. A simple mechanism that holds the controls still while the aeroplane sits on the ground, and that somebody has to remember to release before it leaves it. Nobody had.

An experienced pilot, a remarkable machine, and a small forgotten thing.

They didn't ask for better pilots. They asked for a piece of paper.

Because that's what came next. Air Corps pilots sat down and wrote a card. The obvious things, in order, for take-off, for flight, for landing, including the lock. As the surgeon and writer Atul Gawande tells it, the aeroplane had been called too much for one man to fly, and the answer was never a better man. The answer was the card. The Army bought it after all: thirteen to start with, and in the end nearly thirteen thousand.

That was 1935, the same year Australia's lifesavers planted red and yellow on the sand, colours that probably came from a ship's man-overboard signal, and turned them into the place you'd be safe. Two countries, one year, the same discovery: the heroism happens earlier, at a desk, when somebody calm writes down what to do.

The call that comes from outside

Which brings me home, because last year our own government published a number that belongs on that card.

In its annual threat report, the Australian Signals Directorate counted more than 84,000 cybercrime reports in the year to June 2025, about one every six minutes, and said most cybercrime never gets reported at all. Of the 138 ransomware incidents ASD's own team responded to, 39 per cent began with ASD making contact with the business, not the other way round.

Four in ten. The contact came from outside.

That changes what a plan is for. Most owners imagine the plan as something you reach for when you spot the problem. But often enough the first hour starts with someone else's voice, an agency's, or a customer's, and everything that happens next is decided by what was already written down.

Nobody rises to the occasion at two in the morning. You sink to the level of whatever was written down in advance.

7:40am, the ute

Here's one way it arrives, and it's a common one.

It's 7:40 on a Tuesday. An electrician is in the ute outside his first job, coffee in the cup-holder, and his phone rings. It's a customer he invoiced last week. She's a good one, pays on time, and she's calling to ask why the bank details on his invoice changed.

They didn't. Not by him.

Somebody has been reading his email for a fortnight, and when the right invoice went out they sent a second one behind it with a different account. In the reports Australian small businesses made to Scamwatch in 2025, false billing, generally a payment redirected by an invoice like that one, was the most reported scam of all. It rarely announces itself. Often a customer notices. That's the alarm.

Now watch what panic does, because panic is a plan too. It's just the one nobody wrote down.

He resets the office computer to factory settings, which feels decisive and wipes the record on that machine of what happened, the thing the people who can help will ask for first. He deletes the emails that look wrong, so now there's less to show anyone. He sends a message to his whole client list that reads, to a lawyer, like a confession. And then he sits in the ute and rings whoever comes to mind, which is usually his brother-in-law.

I'm not mocking him. Every one of those moves is what a reasonable person does when nobody handed him the card.

Panic is an incident-response plan. It's just the one nobody wrote down.

I know what you're thinking, because it's what I'd be thinking. You've run your business for years and the phone has never rung like that. I'm not going to argue with your experience. I'll only tell you what the research says about your company in it. When Optus asked a thousand Australian small businesses in 2026, six in ten had no cyber plan at all. The average owner spends two hours a month on the whole subject. Half don't believe they're a target. You're not behind. You're in the majority, and the majority was never given a card either.

The confession

Here's the part my own industry would rather I didn't say.

We've spent twenty years writing incident-response plans for small businesses. They run to forty pages. They have version numbers. They are written to be filed, not read, and on the morning they're needed nobody can find them, and if they could, nobody could get past page two with the phone still ringing.

We wrote the manual. The pilots wanted the card.

The shorter document is the one that gets read at two in the morning.

The card

So here's yours. One page. Five lines, each with what to write down now and what to do on the day. Written on an ordinary Tuesday, with the kettle on, and stuck somewhere you'll find it when you can't think.

One rule before the five, because the order changes with the morning. If money is moving, the bank comes first. If a machine is being encrypted in front of you, photograph the screen and switch it off first. Then the calls.

Who to call. Your bank's fraud line. The Australian Cyber Security Centre on 1300 CYBER1, which is 1300 292 371, any hour. IDCARE on 1800 595 170, free recovery help for small businesses and sole traders, and the one helpline that will also ask how you're going. Whoever looks after your computers, if anyone does. On the day: bank first if money has moved or might, because speed can decide whether a transfer is stopped. Then 1300 CYBER1. Say what you know and what you don't. They've heard worse.

What to unplug. Know where the network cable is and how to turn off the Wi-Fi. On the day: photograph the screen, then disconnect the machine so it can't spread further. If it's ransomware, ASD's advice is then to switch it off. What you don't do is wipe it, reset it, or delete anything.

Where the backups and passwords live. Written down. Not "in my head" and not "somewhere in Google Drive." The name of the backup, where it is, how you'd reach it from a different machine, and how to open the password manager if your usual phone is gone. On the day, if your email was the way in: from a different device, change the email password, sign out of every session, and look for forwarding rules and recovery details you didn't set. That's a start, not a clean-up; the people you called will finish it.

Who you warn, and what you say. If your email was the way in, the people it could reach: the customers who pay you and the people who send money on your behalf, your bookkeeper and your accountant. One sentence, drafted now, when you're calm. "We've had a security incident affecting our email. Please don't act on any payment instructions from us until we've confirmed them by phone." On the day: send the sentence. Not the story, the sentence. Then write down what happened and when, on paper, because you'll be asked and you'll have forgotten.

The clocks. One line, because there are two. If your business turns over more than three million dollars and a ransom is paid, by you or on your behalf, the law gives you 72 hours from the payment, or from learning of it, to report it, and since January the government has moved from explaining that rule to holding businesses to it. And if the Privacy Act covers you, which is most businesses over that threshold and some smaller ones such as health providers, a breach likely to cause serious harm may need to go to the privacy regulator and the people affected. You don't need the detail tonight. What matters is knowing the clocks exist, and that anything with a legal clock is a question for your adviser, your insurer or a lawyer, not a guess.

That's the card. Five lines and a rule. It fits on one page, which is where mine lives.

The last step

There's a line the card can't carry, because it can't check it for you.

Nearly every one of these mornings ends the same way: getting back to work from something clean. A clean email account. A clean machine. A clean copy of your data. The card gets you calmly to that point. It can't tell you whether the clean copy exists.

A plan is only as brave as its last step.

So test it this weekend. Restore one file you'd hate to lose from your backup into a different folder and open it. It proves only that one file, but it's the test you can run tonight, and if it fails, you've learned the most useful thing on this page for nothing.

Here's the honest limit of a piece of paper, and it's the part I said I'd name plainly. A backup that lives on the same machine, or that the same login can reach, can usually be altered or deleted along with everything else. The version that survives that is locked the moment it's written: for a set period nothing, and nobody, including us, can change it or remove it, with a sensor watching the machine and someone checking on the sensor every day, before the morning you'd ever need page one.

That's what a WISECLICK membership is. If you'd rather know first where your own last step stands, the Cyber Report Card takes about 20 minutes and tells you in plain English. It's ours, and it costs $149.

The card was written by people who'd seen the crash

The card that came out of that fire at Wright Field didn't make anyone braver. It meant the next pilot didn't have to be.

Kettle on. One page, five lines, ten minutes for the first draft. Not because the phone will ring. Because if it does, the person who answers it will be the one who wrote things down in advance. That's you.

---

Frequently asked questions

Who do I call first if my business has been hacked?

If money has moved or might, your bank's fraud line, immediately. Then the Australian Cyber Security Centre on 1300 CYBER1 (1300 292 371), 24 hours a day, for incident advice. For recovery support in business hours, IDCARE's Small Business Cyber Resilience Service on 1800 595 170 is government-funded and free for businesses with nineteen or fewer full-time-equivalent staff, not counting the owner, sole traders included, Monday to Friday in business hours, and includes wellbeing support after an incident.

Should I turn the computer off?

Photograph anything on the screen, then disconnect it from the network by unplugging the cable or switching off the Wi-Fi. If it's ransomware, ASD's advice is then to switch the device off to stop it spreading. What matters most is not wiping, resetting or deleting anything, because that record is what the people helping you will ask for.

Do I have to report a cyber attack?

Sometimes. Two rules can apply. If your business turns over more than three million dollars and a ransom is paid, by you or on your behalf, the Cyber Security Act requires a report within 72 hours of the payment or of learning about it. If the Privacy Act covers your business and the incident is what the law calls an eligible data breach, one likely to cause serious harm to the people whose information was involved, the Notifiable Data Breaches scheme requires you to notify the regulator and those people. Reporting to the ACSC itself is free, encouraged, and open to everyone.

Should I pay the ransom?

Australian authorities recommend against it. Paying doesn't guarantee your files come back, it funds the next attack, and over the turnover threshold it triggers a legal reporting obligation. One common reason businesses pay is that they have no clean backup to restore from; another, increasingly, is that criminals threaten to publish stolen data, which no backup can undo. The first is fixable in advance. The second is why the rest of the card matters.

What if it happened weeks ago and I've only just found out?

It happens often. Run the card anyway, in order: bank, call, secure the email, warn the people it could reach, write it down, and don't rebuild until someone who knows has told you it's clean. Then look backwards. Check your email for forwarding rules or filters you didn't create, and check your sent items and bank statements for the weeks you weren't watching. Finding out late is a reason to move, not a reason to stay quiet.

My accountant and bookkeeper have access to my files. Do I need to tell them?

If your email was the way in, warn them, and early. Anyone with a login to your systems, or who sends or receives money on your behalf, belongs on the list: your accountant, your bookkeeper, whoever looks after your computers, and the customers who pay you. Their inbox is where the next fake invoice could land, in your name. Send them the same one sentence. And write their names on the card now, so on Tuesday you're reading a list, not remembering one.

I'm a sole trader with one laptop. Is this overkill?

It's the opposite. With one machine, one email account and one backup, the card takes ten minutes to draft and covers everything you own. Sole traders are the group least likely to have a plan; nearly eight in ten don't. That makes the card worth more to you, not less.

Do I need a consultant to write my incident response plan?

Not to start. The five lines above are the first-response card, and for a one-laptop business that's most of the plan. If someone asks you in writing for a longer document, an insurer or a large customer, the ACSC publishes a free incident response plan template and you can grow the card into it. Start with the card.

---

Stay protected, my friends.

— The Most Secure Man Alive