The cyber threat is no longer just part of catastrophe scenarios reserved for large companies. Today, all organisations, including very small and small/medium businesses, are concerned. In this context, knowing how to react quickly in case of attack becomes essential to limit the damage. It is not so much the size of the company that protects it as its ability to anticipate and act fast when the worst happens.

Putting an emergency plan in place means, above all, equipping yourself with a pragmatic roadmap that can be activated immediately.

Here are the key steps to know to stay on course in the storm.

Quickly isolating the threat

When a cyberattack occurs, time is a decisive factor. The first reaction should be to isolate the threat to prevent it from spreading to the rest of the information system. It may seem obvious, but too many companies are slow to disconnect compromised equipment, leaving attackers all the time they need to gain ground.

In practice, this means cutting Internet access to suspicious machines, temporarily disabling certain network shares, or even suspending access to certain cloud services if necessary. For a small company, this may simply mean switching off certain workstations or asking teams not to connect remotely.

This immediate reaction is the digital equivalent of locking a door when an intruder is spotted in a building. It contains the threat in a restricted area, which will make remediation easier later.

Mobilising a crisis cell

Even a small company must be able to activate a fast decision chain in the event of an incident. The crisis cell is not necessarily a formal structure set up in advance, but it must allow the right people to be gathered around the table, physical or virtual.

Ideally, this cell includes an IT or cybersecurity lead, an operational decision-maker, a legal contact and an external contact such as a specialised provider. Everyone must know their role: who decides to cut access? Who handles communication? Who contacts the authorities if needed?

For organisations without a cybersecurity department, it is advisable to rely on a reliable external partner, such as a specialised IT services company like NUMERYX. This cell, even informal, can make all the difference between a quickly contained attack and a lasting crisis.

Gathering initial information

Once the threat is contained, it is important to draw up an initial incident report. The aim is not to produce a formal document, but to collect as many elements as possible useful for the technical analysis and future decisions.

What symptoms have been observed? Which equipment seems affected? Have suspicious messages appeared? Has the activity of certain software changed? Which services have been slowed or interrupted? This type of information will enable experts, internal or external, to better understand the attack and its impacts.

It is recommended to archive screenshots, note precise dates and times, and avoid deleting any data, even if it seems compromised. These elements may also prove useful if a complaint is filed or if a notification must be made to the CNIL under the GDPR.

Containing and remedying the damage

Once the first containment measures are in place, comes the delicate stage of remediation.

It cannot be improvised because it is not only about neutralising the threat, but also about restoring systems, data, and trust within the organisation.

This critical phase depends directly on the human, technical and organisational resources mobilised. While some companies have the skills in-house, others will have to call on reliable and responsive external support.

Identifying the right resources then becomes a priority to avoid costly mistakes and save precious time in the incident response.

Identifying the right resources

Not all companies have the means to provide a technical response in-house. It is therefore crucial to know who to turn to in an emergency. If you have a managed services provider, contact them immediately. Otherwise, call on a cybersecurity expert, such as those offered by specialised firms like NUMERYX, who can mobilise managed SOC-type services or cyber technical assistance.

In addition, some cyber insurance policies include incident response services: remember to check the clauses of your contract. Finally, if the attack concerns personal data or financial fraud, institutional contacts such as ANSSI, the CNIL or the police via the 17Cyber assistance site can also be mobilised.

Understanding the nature of the attack

With the help of experts, you then need to analyse the attack to identify its origins: how did the attackers get in? Which flaws did they exploit? Did they leave backdoors? This work is essential to secure systems and avoid a repeat.

This diagnosis also helps determine whether data has been stolen, modified or encrypted, and to adapt communication to customers or partners, if necessary.

Returning to normal

Finally, once the causes are identified and vulnerabilities fixed, it is time to restore systems from clean backups. The return to business must be gradual, monitored, and accompanied by functional tests. It is also an opportunity to review internal procedures, identify any gaps and plan future improvements.

A cyberattack can hit anyone, but everyone can prepare

This emergency plan is not reserved for large organisations with an IT department. On the contrary, the smaller the company, the more it needs to structure its response to compensate for a lack of means.

And if you want to go further, other complementary resources await you: discover our first article “How to recognise the signs of a cyberattack?“, which teaches you to detect the warning signs of a cyberattack, and continue with our latest post, dedicated to prevention and building a lasting cybersecurity strategy for your organisation (being published).