Small Business Data Security Emergency Sheet
Print this page, fill in the blanks, and keep copies where the owner, the office manager and the person who covers for them can reach it, including one away from the office computers (a ransomware attack can lock the files you stored this sheet in). Part of the course Securing Your Small Business Data and Systems. Educational only. Facts checked October 2026.
Something looks wrong: the first hour
- Do not turn the machine off yet. Disconnect it from the network (unplug the network cable or turn off Wi-Fi). Power down only if you cannot disconnect.
- Write the time and what you saw. Take a photo of any ransom note or warning.
- Call the people on the list below in order: outside IT, bank (for any money sent), processor (for card data), then others.
- Change passwords and sign out sessions for affected accounts from a clean device. Turn on two-step sign-in if it was off.
- Do not delete anything and do not reply to the attacker. Do not decide about paying a ransom alone and in a hurry.
- Report: FBI at ic3.gov, and CISA for ransomware. Tell customers and staff what they need to know once you have the facts.
Full playbook: When Something Goes Wrong.
Someone asked to move money or change bank details
Verify by calling a number you already have on file. Never reply to the email. Two people approve every payment change.
Sent money by mistake? Call your bank the same minute and ask for a wire recall, then report at ic3.gov. Speed is what gets money back. See Scams aimed at businesses.
My emergency contacts
| Who | Name or account | Phone / after-hours number |
|---|---|---|
| Owner | ||
| Office manager or backup owner | ||
| Outside IT provider or managed service | ||
| Business bank (fraud and wire recall line) | ||
| Card processor or merchant services | ||
| Cyber insurance claim line (if you have a policy) | ||
| Email and website provider (Microsoft 365, Google Workspace, host) | ||
| Domain registrar | ||
| Phone and internet carrier | ||
| Accounting or payroll provider | ||
| Software vendor for key systems | ||
| Key customer contact for urgent notice | ||
| Local police (non-emergency line) | ||
| Other |
Public numbers and sites to report to
| For | Call or visit |
|---|---|
| Internet crime, business email compromise, ransomware (FBI) | ic3.gov |
| Ransomware help and reporting | CISA 1-844-729-2472 or Central@cisa.gov |
| Fraud and scams, business impersonation | ReportFraud.ftc.gov |
| Data breach response guide | FTC "Data Breach Response: A Guide for Business" at ftc.gov |
| Idaho consumer protection | Idaho Attorney General Consumer Protection 208-334-2424 or 1-800-432-3545 (main office 208-334-2400) |
| Mail fraud or theft | U.S. Postal Inspection Service 1-877-876-2455 |
| Phishing email | reportphishing@apwg.org. Phishing text: forward to 7726. |
Key ideas to remember when trouble comes
Layered defense: no single lock
Assume any one layer can fail. Stack them so one mistake does not become a disaster.
- People: short training, a safe way to report a mistake fast
- Accounts: own login for everyone, two-step sign-in, separate admin accounts. Lesson 2
- Devices: updates, protection software, encryption. Lesson 3
- Cloud and email: sharing settings, sender protection. Lesson 4, Lesson 5
- Network: firewall, separate guest Wi-Fi. Lesson 6
- Backups: three copies, two kinds of media, one offline. Test a restore.
Rules that stop most losses
- Call back on a known number before changing payment details
- Two people approve any payment over your limit
- Nobody shares logins or reads out codes
- Gift cards, wires and crypto demands mean fraud
- Remote-support sessions only from people you called
- Remove a leaving employee's access the same day
- Collect and keep less customer data
Ransomware: what to remember
- Disconnect first. Do not wipe or rebuild before getting help.
- Offline, tested backups are your way out.
- The FBI does not support paying. Weigh options with your IT provider and report to law enforcement.
- Check what data was taken, not only locked. That decides who you must notify.
Lost or stolen phone or laptop
- Lock or wipe it remotely. Suspend the line with the carrier.
- Change passwords for email and finance accounts.
- Was customer or employee data on it, and was it encrypted? Write the answer here and call IT.
Where our important things are
Do not write passwords here. Write where to find things.
| Item | Where it is / who has it |
|---|---|
| Admin accounts and who can reset them | |
| Password manager and emergency access | |
| Backups (what, where, last tested date) | |
| Cyber insurance policy and claim line | |
| List of systems that hold customer or card data | |
| Written incident plan and where it is stored offline | |
| Who decides on shutting down, paying or notifying |
Incident log
| Time | What happened or what we did | Who |
|---|---|---|
The full course, lesson by lesson
- 1. Your data and layered defense
- 2. Accounts, passwords and two-step sign-in
- 3. Computers, local data and backups
- 4. Cloud, SaaS and shared files
- 5. Secure email and secure browsing
- 6. Network, Wi-Fi and remote work
- 7. Phones, tablets and mobile devices
- 8. Scams aimed at businesses
- 9. Payment cards, customer data and records
- 10. When something goes wrong
- 11. Policies, training and a 90-day plan
Looking for the home and family version? See the home computer emergency sheet.