Cyberattack Response Plan for SMEs: A Practical Guide

A cyberattack response plan is a short, written guide that tells your team what to do in the first hours of an attack: who is in charge, how to contain the damage, who to call, and what you must report. For a small or mid-sized business, it can fit on a few pages. The point is to make the big decisions now, calmly, instead of at 2am with your systems locked.

Why SMEs need a plan

Small firms are not too small to target. Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of breaches at small and mid-sized organisations, and its 2026 report says small organisations are still hit disproportionately by ransomware. Most attacks are automated and opportunistic: they hit whoever has a weak password or an unpatched server.

When it happens, panic causes expensive mistakes. People wipe infected machines and destroy evidence, pay ransoms too quickly, or miss legal deadlines. A plan prevents that.

Part 1: Prepare before anything happens

Build your response team

Write down names and backups for each role. In a 30-person firm, one person may hold several roles.

• Incident lead: makes decisions and keeps a timeline. Often the owner or GM.
• Technical lead: your IT person or managed service provider (MSP).
• Communications: talks to staff, customers and media.
• Legal / data protection: your data protection officer or lawyer, for PDPA duties.

Keep a contact sheet, offline

Print it. If email and servers are down, you can't look anything up. Include:

• Your team's mobile numbers
• Your IT provider or MSP's emergency line
• An incident response firm (agree terms in advance if you can)
• Your cyber insurer's claims hotline, if you have cover. Many policies require you to call them first
• Your bank's fraud line
• The Malaysian contacts listed later in this article

Know what you have

• A list of key systems and data: accounting, customer records, email, point of sale.
• Which ones hold personal data (this decides your PDPA duties).
• Which order you'd restore them in.

Put the basics in place

• Multi-factor authentication (MFA) on email, remote access and admin accounts.
• Backups you can't lose. Keep at least one copy that attackers can't delete. See immutable backups.
• Logging turned on for email, cloud apps and firewalls, so you can see what happened.
• Least-privilege access, as in zero trust, so one stolen account can't reach everything.

Part 2: The first hours

When someone sees ransom notes, strange logins, or customers report odd emails from you, follow these steps.

1. Raise the alarm and start a log

Call the incident lead. Write down what was seen, when, and by whom. Keep a timeline of every action from now on.

2. Contain, but don't destroy evidence

• Disconnect affected computers from the network (unplug the cable, turn off Wi-Fi). CISA's #StopRansomware Guide advises isolating affected systems straight away.
• Don't switch machines off or wipe them unless your technical lead says so. Evidence lives in memory and logs.
• Reset passwords for affected and admin accounts, from a clean device. Sign out all sessions.
• Disconnect backups from the network if they aren't already protected.

3. Use a separate channel

Assume the attacker can read your email. Use phone calls or a messaging group on personal phones for the response team.

4. Assess what happened

• Which systems are affected?
• Was data copied out, not just encrypted?
• Does it involve personal data? Whose, and how many people?
• Is the attacker still inside?

If you can't answer these, call your incident response firm now.

5. Call your insurer and bank

Your insurer may provide responders and lawyers. If money moved or a fraudulent transfer is in progress, call your bank and the National Scam Response Centre (below) immediately.

Part 3: Who to report to in Malaysia

PDPA: Personal Data Protection Commissioner

Since 1 June 2025, PDPA breach notification is mandatory. Under the Commissioner's guideline, as summarised by DLA Piper and CMS:

• Notify the Commissioner within 72 hours for a personal data breach that causes or is likely to cause significant harm (or affects more than 1,000 people).
• Notify affected individuals no later than 7 days after notifying the Commissioner, where significant harm is likely.
• If you don't have every detail yet, you can send the rest to the Commissioner in phases, within 30 days of your first notice. If you're late, explain why in writing.
• Keep a breach register.

MyCERT (Cyber999)

MyCERT, run by CyberSecurity Malaysia, handles incident reports from businesses and the public through its Cyber999 service. As listed on the MyCERT website (checked October 2026), you can reach it by:

• Phone: 1-300-88-2999 (office hours) or +6019-266 5850 (24 hours)
• Email: cyber999@cybersecurity.my
• The Cyber999 online form or the Cyber999 mobile app

Add these to your printed contact sheet.

NSRC 997: if money was stolen

For online financial fraud, such as a fake supplier invoice that got paid, call the National Scam Response Centre on 997. It runs 24 hours, and the government asks you to report within 24 hours so accounts can be frozen. Also call your bank and lodge a police report.

NACSA: only if you're critical infrastructure

The Cyber Security Act 2024 took effect on 26 August 2024, together with its regulations. It applies to entities designated as national critical information infrastructure (NCII), such as in finance, energy, water and healthcare. According to HHQ, they must notify NACSA's Chief Executive and their sector lead immediately, give details within 6 hours, and a full report within 14 days. Most SMEs aren't NCII, but if you supply one, your contract may require you to report to them quickly.

Part 4: Recover and learn

1. Remove the attacker first. Find how they got in and close it. Restoring before this just invites a second attack.
2. Restore from clean backups, in your priority order. Check that restored systems are patched.
3. Watch closely for a few weeks for signs they're back.
4. Hold a review within two weeks. What worked, what didn't, what will you change? Update the plan.

Should you pay the ransom?

That's a business decision for you, your lawyers and your insurer. Payment doesn't guarantee your data back or stop it being leaked. Having tested backups is what gives you the choice not to pay.

Practise once a year

Run a one-hour "tabletop exercise": sit the team down and walk through a scenario. "It's Monday 8am, the accounting server shows a ransom note. What do we do?" You'll find gaps fast, like nobody knowing the MSP's after-hours number.

Conclusion

A good cyberattack response plan is short, printed and practised. Decide roles, keep an offline contact sheet, contain without destroying evidence, and know your Malaysian reporting duties, especially the 72-hour PDPA clock. For background on breaches themselves, see the data breach guide.

Quick answers

What should be in a cyberattack response plan?

Roles and contacts, a list of key systems and data, first-hour containment steps, reporting duties (PDPA, MyCERT, bank, insurer), and recovery steps.

Who do I report a cyberattack to in Malaysia?

Report incidents to MyCERT's Cyber999 service. If personal data is exposed, notify the PDP Commissioner within 72 hours where required. If money was stolen, call NSRC 997 and your bank.

Should I turn off an infected computer?

Disconnect it from the network instead. Turning it off can destroy evidence in memory that investigators need.

How often should we test the plan?

At least once a year, and after any major change in systems or staff.