Cyber incident response plans: a practical guide for Edinburgh businesses
By Jera IT
Originally published March 2026. Refreshed November 2026: Action Fraud became Report Fraud in December 2025 and still doesn't cover Scotland, so we've updated who to call and tightened the guide into six steps.
Imagine arriving at the office to find every screen showing a ransom demand. Staff are panicking and clients are already emailing. Nobody knows who does what. For most businesses, the first few hours after a cyber attack decide whether it becomes a manageable disruption or a full-blown crisis, and the difference almost always comes down to preparation.
The short answer: an incident response plan is a short, written guide to the first hours of an attack: who’s in charge, and what each person does.
Why Edinburgh businesses can’t afford to wait
A 2025 study by Vodafone put Scotland among the UK regions where small businesses are most likely to suffer a cyber attack (40%), and found that a successful attack costs a Scottish SME almost 30 working hours (29.75), more than almost anywhere else in the UK. The Scottish Government’s Cyber Resilient Scotland 2025–2030 framework makes the same point from the other side: cyber resilience is a business risk, yet relatively few organisations give it board-level ownership.
Attacks are getting faster and more convincing with AI (NCSC, May 2025). In our experience, the businesses that bounce back are the ones that prepared.
The six steps of an incident response plan
1. Build your response team
Name who leads, who handles the technical side, who speaks to staff and clients, and who deals with legal and insurance. For most SMEs, your IT provider fills the technical role. Write down everyone’s mobile numbers, because email may be down.
2. Identify and classify incidents
Not every alert is a crisis. Define what counts as an incident (a suspicious login, a ransom note, a misdirected email containing client data) and set simple severity levels so people know when to escalate.
3. Call your cyber insurer early
Most cyber insurance policies require prompt notification and may provide incident response specialists. Don’t wipe or rebuild anything before they’ve advised you: you can destroy the evidence needed for a claim.
4. Contain and investigate
Isolate affected devices and lock compromised accounts. Then work out how the attacker got in, and whether they’re still there. Short playbooks for your most likely scenarios, such as ransomware or a hacked email account, make this much faster under pressure.
5. Communicate clearly
Decide in advance who tells staff, clients and suppliers, and what they’ll say. Keep staff informed; they’ll know something is wrong. If personal data is affected, you may need to report to the ICO within 72 hours. See failure to notify the ICO.
6. Recover, review and improve
Restore from backups you’ve confirmed are clean, check data integrity, then hold a short review of what worked and what didn’t. Update the plan. This is where tested backups earn their keep.
Who to contact
| Who | When | How |
|---|---|---|
| Your IT provider | Immediately | Their emergency number, written in the plan |
| Your cyber insurer | As soon as an incident is suspected | Policy helpline; note any notification deadline |
| Police Scotland | To report cyber crime | 101, or 999 if a crime is in progress (Scotland is outwith Report Fraud, which replaced Action Fraud) |
| The ICO | Personal data breach likely to put people at risk | Online breach form or 0303 123 1113, within 72 hours |
| Your bank | Any fraudulent payment | Immediately; speed improves the chance of recovery |
| Staff, clients, suppliers | As set out in your communications plan | Prepared messages, from the agreed spokesperson |
Why regular testing matters
A plan in a drawer is not a plan. Run a tabletop exercise at least twice a year: walk through a realistic scenario and see where people hesitate. The National Cyber Security Centre’s free Exercise in a Box gives you ready-made scenarios to do exactly that.
Where an AI agent helps
Two agents support the plan before and during an incident:
- The AI Security-Monitoring Agent ↗ watches for threats around the clock and raises the alarm, so step 2 starts sooner.
- The AI Compliance Agent ↗ keeps track of your obligations, including breach reporting deadlines.
See all our agents in the solutions library on jerait.ai ↗, or find the right agent for your business on jerait.ai ↗.
The catch: the AI an agent runs on is paid for by use. With Jera IT support, your first agent is built, supported and maintained free; we give you a rough idea of the usage cost before you commit, and a real figure from the trial.
How Jera can help
We help Edinburgh businesses write an incident response plan around their own risks and keep it current, and when something happens we respond as part of our managed IT and cyber security services. Book a call and we’ll help you write your plan.
Frequently asked questions
What is a cyber incident response plan?
It's a short, written plan that sets out how your business will contain and recover from a cyber attack: who is in charge, who to call, what to do first, and how to communicate. It turns a panic into a checklist.
What should an incident response plan include?
Team roles and contact details, how to recognise and classify incidents, steps for common scenarios such as ransomware and phishing, insurer and regulator deadlines, a communications plan for staff, clients and suppliers, recovery steps using backups, and a post-incident review.
How often should we test our incident response plan?
At least twice a year, and whenever key people, systems or suppliers change. A tabletop exercise of an hour or two is enough to reveal most gaps.
Do small businesses really need an incident response plan?
Yes. Smaller businesses are frequent targets because attackers expect weaker defences, and they have the least slack to absorb days of downtime. A plan of two pages is enough for most SMEs.
How do I report a cyber attack in Scotland?
Report cyber crime to Police Scotland on 101 (or 999 if a crime is in progress). Report Fraud, which replaced Action Fraud on 4 December 2025, covers England, Wales and Northern Ireland; Scotland is outwith it. If personal data is affected, you may also need to report to the ICO within 72 hours.
Sources
- Report Fraud service goes live, City of London Police
- Securing Success: The Role of Cybersecurity in SME Growth (April 2025), WPI Strategy for Vodafone UK
- Impact of AI on cyber threat from now to 2027, National Cyber Security Centre
- Exercise in a Box, National Cyber Security Centre
