Most South Australian councils, not-for-profits and small businesses now have some of the basics in place: multi-factor authentication, backups, a managed antivirus and an IT provider on call. What many still lack is a short, tested plan for the day something gets through. When a staff mailbox starts sending fake invoices, files suddenly will not open, or a supplier rings to say your bank details have changed, the first hour decides how much the incident costs. This guide explains, in plain words, what a cyber incident response plan should cover, what to do in the first 72 hours, and which reporting obligations may apply. It is practical guidance, not legal advice.
Why a written plan matters more than another tool
During an incident people are stressed, systems may be down and the person who “knows the IT” may be on leave. Without a plan, teams lose hours deciding who is in charge, whether to switch things off, who to call and what to tell customers. Common, expensive mistakes include wiping an infected laptop before anyone has captured what happened, restoring backups that are already compromised, paying a fake invoice while the investigation is under way, and staying silent with customers until they hear about it elsewhere.
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) publishes a free small business hub and incident response plan guidance and template. You do not need a 60-page document. For most small organisations, a plan of four to six pages that people have actually read and practised is far more useful than a long one nobody can find.
What your incident response plan should cover
| Section | What to write |
|---|---|
| Roles | Who leads the response, who can approve shutting systems down or spending money, who talks to customers and media, and a deputy for each. Name roles rather than one person. |
| Contacts | Your IT or managed service provider, cyber insurer and its incident hotline, bank fraud team, key software vendors, legal adviser and the Australian Cyber Security Hotline (1300 CYBER1, 1300 292 371). Keep a printed copy, because email and shared drives may be unavailable. |
| Critical systems | A short list of the systems you cannot run without, such as email, finance, payroll, bookings, the website and customer records, with where each is hosted, who supports it and how long you could cope without it. |
| Severity levels | Simple definitions for low, medium and high incidents, and what each one triggers. A single phished account with no data accessed is not the same as encrypted servers. |
| Playbooks | One-page checklists for the incidents you are most likely to face: business email compromise, ransomware, a lost or stolen device, a compromised website and a supplier breach. |
| Evidence | What to keep before anything is changed: logs, suspicious emails as attachments, screenshots, timestamps and a running incident log of who did what and when. |
| Reporting | Which notifications might apply, who decides and the time limits (see below). |
| Communication | Holding statements for staff, customers and suppliers, and an out-of-band way to talk, such as a phone tree or a separate messaging group, in case your own email is compromised. |
| Recovery | How you restore from backup, check that restored systems are clean, reset credentials and decide when it is safe to return to normal. |
The first 72 hours
First hour: contain and record
- Start an incident log immediately, with times, what was seen, decisions and who made them.
- Isolate affected devices from the network (disconnect the cable or Wi-Fi) rather than powering them off or wiping them, so evidence is preserved. Follow your IT provider’s advice for servers and cloud systems.
- For a suspected compromised account, reset the password from a clean device, revoke active sessions and check mailbox rules and forwarding, which attackers often add to hide their activity.
- Call your IT provider and, if you have one, your cyber insurer’s hotline early. Many policies expect prompt notice and may require you to use their approved responders.
- Warn your finance team to pause any change to bank details or urgent payment request until it has been verified by phone using a number you already hold.
First day: understand the scope
- Work out which accounts, devices, systems and data were affected, and how the attacker got in, so you close that door before restoring anything.
- Check whether personal information may have been accessed or taken, because that starts the privacy assessment clock.
- Protect your backups. Confirm they are offline or immutable and have not been touched before you rely on them.
- Report the incident to ASD’s ACSC through ReportCyber or the hotline. Reporting is free and can bring technical advice.
- Send a short, factual holding message to staff, and to customers or suppliers if they may be affected or need to take action.
Days two and three: recover and decide
- Restore critical systems in priority order from known-clean backups, rebuilding devices where needed, and reset passwords and keys that may have been exposed.
- Watch closely for the attacker returning, especially through mailbox rules, new admin accounts, remote access tools and third-party connections.
- Make and document decisions on notifications with your advisers, and keep updating the people you have already told.
Reporting obligations that may apply
Which obligations apply depends on the type of organisation, its size and what happened. Common ones for SA organisations include:
- Notifiable Data Breaches (NDB) scheme. If your organisation is covered by the Privacy Act and personal information may have been accessed or lost, you must take reasonable steps to assess the suspected breach within 30 days, and notify the OAIC and affected individuals as soon as practicable if it is likely to cause serious harm. Our Privacy Act and NDB guide explains who is covered and how the clocks work.
- Ransomware and cyber extortion payments. Since 30 May 2025, businesses carrying on business in Australia with annual turnover above $3 million, and responsible entities for critical infrastructure assets, must report a ransomware or cyber extortion payment to ASD within 72 hours of making it or becoming aware it was made on their behalf. Commonwealth and State bodies are excluded from this particular obligation, so councils and agencies should confirm their own position and follow their sector’s reporting arrangements.
- Contracts and government work. Suppliers to SA Government agencies are often required by contract to report security incidents within set times under the agency’s security framework. See our guide to the SA ISMF for ICT suppliers.
- Insurance and regulators. Cyber insurance policies usually require prompt notice, and regulated entities or their suppliers may have shorter clocks. Our article on resilience testing and incident reporting runbooks covers those in more depth.
Paying a ransom does not guarantee you will get your data back or that it will not be published, and the Australian Government advises against paying. Make that decision with legal and specialist advice, never alone in the first hour.
Preparing before anything happens
- Get the basics in place. Multi-factor authentication on email and remote access, patched devices and offline or immutable backups prevent and limit most common incidents. Our Essential Eight guide explains where to start.
- Protect your domain. SPF, DKIM and DMARC make it harder for criminals to send email that looks like it came from you. See our email security guide.
- Test restores, not just backups. Restore a real system at least twice a year and time it. Our backup and disaster recovery guide covers recovery targets.
- Turn on and keep logs. Sign-in and audit logs for Microsoft 365 or Google Workspace, firewalls and key applications, kept long enough to investigate an incident found weeks later.
- Know your suppliers. List which suppliers hold your data or can access your systems, and how they will tell you about an incident on their side.
- Train staff to report early. A staff member who reports a suspicious click within minutes is worth more than any single tool. Make reporting easy and never punish an honest mistake.
Run a one-hour tabletop exercise
A tabletop exercise is a guided discussion where your team walks through a realistic scenario using the plan. ASD’s ACSC offers free exercise material for small businesses. A simple version works well:
- Pick a scenario: “Our accounts mailbox has been sending invoices with changed bank details for two days.”
- Gather the people who would really respond: a manager, finance, IT support and whoever talks to customers.
- Walk through the first hour, first day and first week, asking who does what, who decides and who needs to be told.
- Note every gap: missing phone numbers, unclear authority, logs that are not kept, backups nobody has tested.
- Fix the gaps, update the plan and repeat with a different scenario in six months.
A one-page checklist
- Named incident lead and deputy, with authority to act.
- Printed contact list, including IT provider, insurer, bank and 1300 CYBER1.
- List of critical systems and how long you can cope without each.
- Playbooks for email compromise, ransomware and a lost device.
- Backups that are offline or immutable, with a restore tested this year.
- Logs switched on and retained for key systems.
- Reporting decisions mapped: NDB, ransomware payments, contracts and insurance.
- Holding statements ready for staff and customers.
- A tabletop exercise completed in the last twelve months.
This article reflects Australian guidance and legislation as at late 2026. Obligations, thresholds and reporting channels change, so confirm current requirements on cyber.gov.au and with the OAIC, your insurer and your advisers.
Talk to an Adelaide team
If you want an incident response plan your team will actually use, talk to us about cyber readiness or call 0402 401 584. We can review your current controls, draft a short plan and playbooks around your real systems, check that your backups restore, and run a tabletop exercise with your team. Learn more about our managed IT and cyber security, DevOps and cloud and team training services.