# How do you build an email security incident response plan for a small business?

URL: https://iblockspam.com/blog/email-security-incident-response-plan
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> A small-business playbook for email incidents: roles, first-hour steps, containment in Microsoft 365 and Google Workspace, evidence, notices and lessons.

## Short answer

An email incident plan names who leads, who touches the systems and who calls the bank, then lists first-hour steps for each common case: a phishing click, a compromised mailbox, a fraudulent payment and malware. It says how to contain the account, what evidence to keep, who to notify and when to review lessons learned. Keep a copy outside email.

Most small businesses already know what to do when a laptop is stolen or the internet goes down. Email incidents are different: they start quietly, they move money, and the person who notices first is often a customer. A short written plan turns a stressful hour of guessing into a checklist. This guide gives you the structure, the first-hour steps and the platform-specific containment for Microsoft 365 and Google Workspace.

## What should an email incident response plan cover?

Plan for the four incidents that small businesses actually see. Each needs a slightly different first move.

| Incident | Typical first sign | First priority |
|---|---|---|
| Phishing click | A user reports clicking a link or entering a password | Reset, revoke sessions, find other recipients |
| Compromised mailbox | Odd inbox rules, sent mail nobody wrote, a send block | Cut off access and remove persistence |
| BEC payment | A supplier or customer asks where a payment went | Call the bank to recall the funds |
| Malware from an attachment | Security alert, strange behavior after opening a file | Isolate the device |

The plan doesn't need to be long. The [NCSC's small business response guide](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery) works in five steps: prepare, identify what's happening, resolve, report to stakeholders, and learn. Two or three pages that people will actually read beat a binder nobody opens.

## How does this map to NIST SP 800-61r3 and CSF 2.0?

NIST published [SP 800-61 Revision 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final) in April 2025. It supersedes the 2012 Revision 2 and reorganizes incident response around the six NIST Cybersecurity Framework (CSF) 2.0 Functions. The document says "All six NIST Cybersecurity Framework (CSF) 2.0 Functions play vital roles in incident response", and explains the split:

- **Govern, Identify and Protect** "help organizations prevent some incidents, prepare to handle incidents that do occur, reduce the impact of those incidents, and improve" based on lessons learned.
- **Detect, Respond and Recover** help organizations "discover, manage, prioritize, contain, eradicate, and recover from cybersecurity incidents", plus reporting and notification.

Revision 3 also drops the old circular life cycle. NIST notes that it was drawn when incidents "were relatively rare" and response was "usually completed within a day or two". Here's how an email plan fits the six Functions:

| CSF 2.0 Function | What it means for email |
|---|---|
| Govern | Name an incident lead, set when to call outside help, and decide who can authorize payments or notices |
| Identify | Know your domains, mail platform, admins, logging and who your bank contacts are; feed lessons learned back in |
| Protect | MFA, blocked external auto-forwarding, inbound filtering, SPF, DKIM and DMARC, payment-change callbacks |
| Detect | User reporting, alert policies, sign-in alerts, warnings from suppliers and customers |
| Respond | Contain the account or device, preserve evidence, remove malicious mail, notify the right people |
| Recover | Restore sending, recover funds where possible, reopen access safely, confirm normal operation |

You don't need to adopt the full framework to use this. It's a useful checklist that what you write covers both the incident and the work around it.

## Who does what during an email incident?

The NCSC advises you to "assign roles to members of staff, and document who owns each responsibility in the event of an incident". In a small firm one person may hold two roles, but every role needs a named backup.

| Role | Who, typically | Owns |
|---|---|---|
| Incident lead | Owner or operations manager | Decisions, priorities, the timeline, when to escalate |
| Technical lead | IT admin or managed service provider | Account containment, log review, message removal |
| Finance contact | Bookkeeper or finance manager | Bank calls, payment holds, recall requests |
| Communications | Owner or account manager | Calls to affected customers and suppliers, staff updates |
| Outside help | Bank, insurer, lawyer, IT provider | Recovery of funds, coverage terms, legal duties, forensics |

Write phone numbers on paper or in a shared document outside your mail system. The NCSC warns that "your normal means of communication may be disrupted during an incident", and in an email incident the attacker may be reading the mailbox you'd normally use.

## What should you prepare before anything happens?

1. **Write down your admin accounts** and make sure at least two people can reach the admin console, using MFA.
2. **Check log retention now.** In Microsoft 365, Microsoft says Audit (Standard) records generated on or after October 17, 2023 are kept for 180 days by default, and E5-level licensing keeps Exchange, SharePoint, OneDrive and Entra records for a year ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-log-retention-policies)). In Google Workspace, Google says the User log events show web-based sign-ins for up to 6 months.
3. **Know your bank's fraud line** and ask how it handles wire recall requests.
4. **Block external auto-forwarding** and turn on alerts for new forwarding rules; see [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).
5. **Agree a payment-change rule**: any new or changed bank details get a phone callback to a known number.
6. **Run a tabletop exercise.** The NCSC says "the best way to test your staff's understanding of what's required during an incident is through exercising". Thirty minutes walking through "the CFO's mailbox sent an invoice" is enough to find the gaps.

## What do you do in the first hour?

Start a timeline the moment someone raises the alarm. Note the time, who reported what, and every action taken. Then work through the steps for the incident type.

### Phishing click or entered password

1. Get the facts from the user: what they clicked, what they typed, whether they approved an MFA prompt.
2. Reset the password from a trusted device and revoke the user's sessions.
3. Find and remove the same message from every other mailbox.
4. Block the sender, domain or URL across the organization.
5. If they entered a password, treat it as a compromised mailbox below.

The user-facing steps are in [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

### Compromised mailbox

1. Disable the account or block sign-in.
2. Revoke all sessions and refresh tokens.
3. Record, then remove, inbox rules, forwarding, delegates and unknown MFA methods.
4. Review app consents and admin roles.
5. Pull the sign-in and audit logs for the attack window.
6. Check sent mail for payment requests or phishing sent to contacts.

[Signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) has the full recovery procedure, including the PowerShell commands.

### BEC payment already sent

1. **Call the bank first.** The FBI's [IC3](https://www.ic3.gov/CrimeInfo/BEC) says to "contact the originating Financial Institution as soon as fraud is recognized" and ask for a recall or reversal and a Hold Harmless Letter or Letter of Indemnity.
2. File a complaint at ic3.gov. IC3 says it is "vital the complaint contain all required data in provided fields, including banking information."
3. Then investigate how the fraud happened: a compromised mailbox on your side, the supplier's side, or a [lookalike domain](https://iblockspam.com/blog/lookalike-domain-phishing).

Our [vendor invoice fraud guide](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) covers the payment side in more depth.

### Malware from an attachment

1. Disconnect the device from the network. Don't wipe it.
2. The [FTC's breach response guide](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) says to "take all affected equipment offline immediately" but not to turn machines off until forensic experts arrive.
3. Reset passwords used on that device, from a different device.
4. Find and remove the message from other mailboxes, and block the attachment type or sender.

## How do you contain an account in Microsoft 365 and Google Workspace?

### Microsoft 365

[Microsoft's compromised account guidance](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account) says disabling the account "is preferred and highly recommended until you complete the investigation." Its steps, in order, are: disable the account, revoke user access with `Revoke-MgUserSignInSession`, review MFA devices, review consented applications, review admin roles, and review mail forwarders and inbox rules (including hidden ones). It warns not to send the new password by email "because the attacker could have access to the mailbox", and that app passwords "aren't automatically revoked when you reset the password."

To pull the malicious message from every mailbox, Defender for Office 365 Plan 2 lets you remediate from Threat Explorer; see [Threat Explorer and Real-time detections](https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections). For the logs, see [the Microsoft 365 audit log for email investigations](https://iblockspam.com/blog/microsoft-365-audit-log-email-investigation).

### Google Workspace

Google's [compromised account steps](https://knowledge.workspace.google.com/admin/support/troubleshooting/identify-and-secure-compromised-accounts) are: suspend the user, reset the password, revoke OAuth 2.0 tokens, remove app passwords, enforce 2-Step Verification, check filters and forwarding, review the logs and wipe suspicious mobile devices. Google notes that suspending a user resets the user's sign-in cookies and OAuth tokens. To find and remove a message across the domain, see [the Google Workspace security investigation tool](https://iblockspam.com/blog/google-workspace-security-investigation-tool) and [Email log search](https://iblockspam.com/blog/google-workspace-email-log-search).

## What evidence should you preserve?

Preserve first, clean up second. The FTC is blunt: "Do not destroy evidence."

- **The original message**, saved with full headers (as an .eml or .msg file, not a screenshot). The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) reads them in your browser.
- **Inbox rules and forwarding settings**, exported or photographed before you delete them.
- **Sign-in and audit log exports** covering the whole attack window, saved outside the platform.
- **Message trace or log search results** showing who received the message and what the account sent.
- **Payment records**: invoices, bank details given, transfer confirmations, call notes.
- **Your timeline**, with times and who did what.

Store copies somewhere the attacker can't reach, and limit who can edit them.

## Who do you need to notify?

This section is general information, not legal advice. Notification duties depend on where you operate, your industry and what data was involved, so involve a lawyer when personal data may have been exposed.

| Who | When to consider it |
|---|---|
| Your bank | Immediately, if money moved or bank details were exposed |
| Law enforcement | Fraud or theft; in the US, IC3 for BEC, and the FTC suggests your local police |
| Your insurer | Early; many cyber policies set notice deadlines and approved vendors |
| Affected customers and suppliers | If they received fraudulent mail or payment instructions from you; call them |
| Individuals whose data was exposed | Where breach notification laws apply; the FTC notes that all US states, DC, Puerto Rico and the Virgin Islands have such laws |
| Regulators | If your sector or jurisdiction requires it |

For contacts who may have received phishing from your account, the [NCSC's hacked account advice](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account) is to tell them and suggest they treat recent messages from you with suspicion. Use a phone call for anything involving payments.

## How do you run the lessons-learned review?

Hold it within two weeks, while memories are fresh. NIST SP 800-61r3 says lessons "should often be shared as soon as they are identified, not delayed until after recovery concludes", so fix obvious gaps immediately and use the meeting for the rest. The NCSC suggests making "a list of things that went well and things that could be improved", updating the plan, and reassessing risk.

Useful questions:

1. How did the message or attacker get in, and which control should have stopped it?
2. How long between the first sign and someone acting on it?
3. Which step in the plan was missing, unclear or wrong?
4. Did anyone hesitate to report because they feared blame?
5. What one change would most reduce the chance of a repeat?

Then make the change. Typical outcomes are MFA for a missed account, blocked forwarding, a callback rule for payments, or better [inbound filtering](https://iblockspam.com/blog/how-spam-filters-work).

## Next steps

1. Copy the role table and first-hour steps into a two-page document and fill in real names and phone numbers.
2. Store it outside your email system, and print a copy.
3. Check your audit log retention and admin access this week.
4. Run a 30-minute tabletop exercise on the BEC scenario.
5. Reduce how often the plan is needed: iBlockSpam filters phishing, spoofing and malware at the MX before mail reaches Microsoft 365, Google Workspace or cPanel; see [how it works](https://iblockspam.com/how-it-works).

Browse our other [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### What should a small business email incident response plan include?

Named roles with backups, an offline contact list (bank, IT provider, insurer, lawyer), first-hour steps for phishing clicks, compromised mailboxes, fraudulent payments and malware, the exact containment steps for your mail platform, a list of evidence to keep, notification triggers, and a date for a lessons-learned review. Two or three pages is enough for most small firms.

### Who should lead an email security incident in a small company?

Pick one decision maker, usually an owner or operations manager, plus a deputy. The technical work often belongs to your IT provider or admin, and finance should own any contact with the bank. The NCSC advises assigning roles and documenting who owns each responsibility, so nobody has to work it out mid-incident.

### Should we switch off a computer that opened a malicious attachment?

Disconnect it from the network first, by unplugging the cable or turning off Wi-Fi. The FTC's breach guide says to take affected equipment offline immediately but not to turn machines off until forensic experts arrive. Powering down can also lose evidence held only in memory. Follow your IT provider's instructions after that.

### How long does Microsoft 365 keep audit logs for an investigation?

Microsoft says Audit (Standard) records generated on or after October 17, 2023 are kept for 180 days by default. With E5-level licensing, Exchange, SharePoint, OneDrive and Entra records are kept for one year. Check yours before you need them, and export the relevant records early in an incident.

### Does NIST SP 800-61 Revision 3 still use the four-phase incident life cycle?

No. Revision 3, published in April 2025, replaces the old life cycle (preparation; detection and analysis; containment, eradication and recovery; post-incident activity) with the six NIST CSF 2.0 Functions. Govern, Identify and Protect cover preparation and lessons learned; Detect, Respond and Recover cover the incident itself.

## Sources

- [NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025)](https://csrc.nist.gov/pubs/sp/800/61/r3/final)
- [UK NCSC: Small Business Guide: Response and Recovery](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery)
- [Microsoft Learn: Respond to a compromised email account in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)
- [Google Workspace Admin Help: Identify and secure compromised accounts](https://knowledge.workspace.google.com/admin/support/troubleshooting/identify-and-secure-compromised-accounts)
- [FBI IC3: Business Email Compromise](https://www.ic3.gov/CrimeInfo/BEC)
- [FTC: Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business)
- [Microsoft Learn: Manage audit log retention policies](https://learn.microsoft.com/en-us/purview/audit-log-retention-policies)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-incident-response-plan (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt