When nothing works tomorrow morning
Monday, 7:30 a.m. Every screen shows a ransom note. Or the server won't start after a power cut. Who calls whom? Where are the credentials? Which customers need to be informed?
An IT emergency plan answers these questions before it happens. For a small business a few pages everyone can find are often enough.
What belongs in an emergency plan
1. Emergency contacts
- Who decides in an emergency?
- IT service provider with phone number
- Insurer (for cyber insurance: the emergency hotline in the policy)
- Bank, if payments are affected
- Data protection officer, if any
- Police: German state criminal police offices have central cybercrime contact points (ZAC) for businesses.
Important: keep this list printed. If computers are encrypted, you can't reach digital contacts.
2. First steps
- Disconnect affected devices from the network but do not switch them off.
- Inform the responsible person and your IT provider.
- Delete nothing, pay no ransom, no DIY repairs.
- Write down what was noticed when and who did what.
3. Key systems and order
Decide what must run first, often email and phone, then order processing and accounting. Note how long you can manage without each system.
4. Backups and recovery
- Where are backups, and is at least one separated from the network?
- Who can restore?
- When was a restore last tested?
More in our article on backup strategies.
5. Reporting duties
If personal data is affected, a report to the data protection authority may be required, usually within 72 hours. If your business falls under NIS2, additional reporting to the BSI applies, see our NIS2 article.
6. Communication
Prepare short text blocks for staff, customers and a notice.
Build the plan in one afternoon
- Use a template. The BSI provides free emergency-management aids for small businesses.
- Fill in contacts and responsibilities.
- Define your five most important systems and their order.
- Print it, store it in two places and digitally outside your company IT.
- Review yearly and walk through it once.
Common mistakes
- Plan only on the server.
- No deputy.
- Never practised.
- Missing credentials: admin logins, router password and licence keys belong in a secure password manager with emergency access.
FAQ
Do small businesses really need one? Yes. They rarely have reserves to work for days without IT.
How often should I update it? At least yearly and after any major change.
Conclusion
A good emergency plan is short, printed and known. It doesn't prevent an attack, but it decides whether an incident becomes a crisis. See our IT security services.
