Incident Response Policy: A Plain-English Guide for Australian Businesses

The strongest recurring demand is practical: what to do immediately, who to tell, and whether a legal clock has started. A high-demand question missing from the fixed 10 is how to communicate consistently with staff, customers, suppliers and media while facts are still changing.

• annual turnover A$3m or less — Most small businesses in this band are not covered by the Privacy Act, but important exceptions apply and ASD guidance still recommends an incident response plan.
• Privacy Act-covered entity — The policy should connect directly to the Notifiable Data Breaches assessment and notification process.
• customer, insurer or certification obligations — Contractual notification deadlines and evidence requirements may be stricter than the general legal baseline.

Purpose and scope. This policy establishes how [Business Name] identifies, reports, assesses, contains, investigates, communicates about, recovers from and learns from cyber security and data incidents. It applies to all workers, systems, information, locations and third parties handling our information. Anyone who suspects an incident must report it immediately through [primary channel] or [24/7 backup channel]. The Incident Lead may activate the Incident Response Plan and must preserve a record of decisions and actions.

• micro or owner-operated business — Roles may be combined, but primary and backup contacts, decision authority and external support details must still be explicit.
• larger or multi-site business — Separate operational response, executive crisis management, communications, legal, privacy, HR and business recovery roles.
• outsourced IT or managed service provider — The policy should distinguish the provider's technical tasks from the business's legal, customer, financial and risk decisions.

Minimum content. Our incident response arrangements must document: purpose and scope; definitions and severity criteria; immediate reporting channels; activation and stand-down authority; named primary and backup roles; 24/7 contact methods; containment, investigation, evidence, remediation and recovery pathways; legal, regulatory, contractual, insurer and customer notification assessment; internal and external communications; third-party coordination; incident records; post-incident review; training, exercising, approval and document control.

• Privacy Act-covered entity — Apply the NDB assessment and notification tests; the clock is not a blanket 72 hours.
• around A$3m annual turnover — Privacy Act small-business coverage and ransomware-payment reporting use different tests; exceptions and boundary wording need separate checking.
• responsible entity for critical infrastructure — SOCI incident reporting can require a report within 12 hours for significant impact or 72 hours for relevant impact.
• regulated or contract-bound business — Sector regulators, licences, customer contracts and cyber-insurance policies may add shorter or parallel deadlines.

Notification clocks. The Legal/Regulatory Lead must start a notification assessment immediately and maintain a clock register for every potentially applicable law, regulation, contract, insurer condition and customer commitment. The register must record the trigger, clock start, deadline, decision, decision-maker, advice received and proof of submission. The business must not assume a universal 72-hour rule and must apply the shortest applicable deadline.

• owner-operated business — The owner or managing director normally approves the policy and names a technical adviser plus an alternate decision-maker.
• company with executives or a board — A senior risk owner should be accountable, with approval set by the organisation's governance and regulatory obligations.
• outsourced technology — The provider may lead technical containment, but the business retains authority over legal reporting, ransom decisions, customer communications and risk acceptance.

Ownership and authority. The Policy Owner is [role]. The Incident Commander is [role], with [alternate role] as backup, and may activate the plan, direct urgent containment, engage approved external advisers and escalate to the Executive Response Team. [CEO/Managing Director/Board or delegated committee] approves this policy. Technology providers advise and perform authorised technical work; they do not replace the business's legal, regulatory, customer, financial or risk decision-makers.

• all workers — Teach one immediate reporting action and make clear that suspicion is enough to report.
• incident responders — Provide role cards, contact trees, playbooks, decision logs and exercised backup communications.
• suppliers and contractors — Contracts and onboarding should state who reports, through which channel, and within what contractual timeframe.

Report first. Any worker who notices or suspects an incident must immediately contact [channel] or [backup number]. The worker is not required to investigate, prove fault or obtain manager approval before reporting. No person will be penalised for a good-faith report. Only authorised responders may investigate, contain, communicate externally or alter affected systems.

• audit or certification — Show controlled documents, training, exercise results, incident registers, corrective-action tracking and management endorsement.
• cyber insurance — Keep evidence of declared controls, notification to the insurer, approved advisers, decision records and compliance with policy conditions.
• small business — A simple ticket register, annual exercise record, contact test and signed action list can demonstrate operation without an enterprise platform.

Records and evidence. Every incident and exercise must have a unique case identifier and a time-stamped record of reports, decisions, approvals, actions, evidence collected, people consulted, notifications, recovery checks, lessons and corrective actions. Records must be protected from unauthorised alteration or deletion. Where litigation, regulation, insurance or investigation is reasonably anticipated, the Incident Lead must seek advice on preservation and legal hold before data, devices, accounts or logs are deleted, reset or rebuilt.

• ASD ISM-aligned — Exercise the policy and plan at least annually.
• rapidly changing or high-risk business — Review contacts, suppliers, critical assets and notification obligations more frequently than annually.
• after legal or regulatory change — Run an immediate targeted review of thresholds, clocks, regulator contacts and approval paths.

Review and exercise. This policy and the linked Incident Response Plan must be reviewed at least annually and exercised at least annually. An off-cycle review is required after any material incident, material exercise finding, significant change to systems, services, structure, personnel, suppliers or critical information, and any relevant change to law, regulation, contract, insurance or government guidance. Each review must record changes, owner, approver, approval date and next review date.

• small business — Watch for single-person dependency, router or remote-access exposure, missing logs, untested backups and no alternate communications.
• cloud and SaaS-heavy business — Confirm who can suspend accounts, export logs, preserve data and contact the provider when the primary identity platform is unavailable.
• managed service provider — Define notification, evidence, access, cooperation, subcontractor and decision-right obligations in the contract and plan.

Resilience requirements. The response process must not rely solely on corporate email, a single person, a single device or a single supplier contact. Primary and backup contacts, out-of-band communications, offline plan access, current system and supplier inventories, tested backups, sufficient logging, evidence-preservation steps and pre-approved escalation paths must be maintained and tested. Any material gap identified in an incident or exercise must be assigned an owner and due date and tracked to closure.

• low-severity or contained event — Log, validate, contain, preserve evidence and confirm whether escalation or notification assessment is required.
• high-severity or uncertain event — Activate executive response, clean communications, external technical support, legal and privacy assessment, insurer contact and business continuity.
• possible reportable incident — Record the earliest possible trigger time and assess every applicable reporting clock immediately.

First 60 minutes. On activation, the Incident Lead must: acknowledge the report; open the incident record and decision log; assign severity and roles; protect life, safety and critical operations; authorise proportionate containment; preserve relevant evidence and logs; establish a trusted backup communication channel where required; identify affected systems, information and third parties; begin legal, regulatory, contractual and insurer notification assessments; and brief the accountable executive. Destructive remediation, ransom payment and external statements require the approvals defined in the Incident Response Plan.

This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.