Yes — the value of a written plan is precisely that it exists before an incident, when there’s time to think clearly, rather than being improvised during one, when there usually isn’t.
What a minimal but useful plan includes
- Who’s responsible for what during an incident (even if it’s the same one or two people for everything)
- Key contacts: hosting provider, domain registrar, a security contact if you have one
- A basic decision tree: take the site offline or not, who has authority to make that call
- Notification templates or at least a rough outline for customer communication
- Where backups are and how to actually restore from them — tested in advance, not assumed to work
Why "we’ll figure it out" isn’t sufficient
Decisions made under pressure without a plan are demonstrably where the most costly incident-response mistakes happen, both technically and in terms of legal/communication missteps.
FAQ
How detailed does a small business plan really need to be?
Even a single page covering contacts, key decisions, and backup restoration steps is far better than nothing, and is a realistic starting point rather than an elaborate enterprise document.