Recovering from a cyber attack: the NCSC's three stages for small firms

Most small business advice about cyber security is about stopping an attack. The National Cyber Security Centre (NCSC) has now published guidance on the other half of the problem: what to do in the hours, days and weeks after one gets through. It is written for organisations of all sizes, and the ideas translate well to a firm with a handful of staff and a few cloud systems.

What the NCSC published

In July 2026 the NCSC released guidance on responding to and recovering from highly disruptive cyber attacks, such as ransomware. It splits recovery into three stages:

• Initial response: the first hours and days, focused on quick defensive action, setting up who decides what, and regaining control of communications.
• Recovery to minimum viable operations: getting back to a baseline level of service, possibly with temporary workarounds.
• Long-term recovery: returning to normal by fixing the underlying causes and rebuilding in a more secure, resilient way.

The NCSC also recommends bringing in an incident response firm vetted by the agency during the first stage. Its ransomware page goes further, saying it recommends that all UK organisations use an NCSC-assured Cyber Incident Response provider, whatever their size or type.

What "minimum viable operations" means for a small firm

The phrase sounds corporate, but the idea is simple: which few things must work for you to keep trading, even badly? For a takeaway, that might be taking orders and printing them in the kitchen. For a trades business, it might be a customer list, a diary and a way to send invoices. For a shop, it might be the till and card payments.

The NCSC's preparation page says recovery planning covers four areas: business continuity, people, technical recovery and critical decisions. It asks you to plan how critical services keep running during disruption, to make sure staff have clear roles and defined ways to communicate, to set up the systems and data needed to restore technology securely, and to give leaders the authority to make timely decisions. It also says to plan for attacks on suppliers, managed service providers and technology providers, not only on your own systems. If your website, booking system or payments run through a third party, that last point matters.

Practise it, do not just write it

The NCSC's chief technology officer for economy and society argued in a 27 July blog post that a plan is not enough and that organisations should actually practise and test their response. According to Infosecurity Magazine's report, the exercises suggested include testing failover systems, rehearsing shutdown and restart procedures, and rebuilding systems from backups. The same blog argued that realistic simulations build instinctive responses better than tabletop discussions.

You do not need a simulation suite to take that seriously. A small business can run a version in an afternoon: pick one system, pretend it is gone, and see how long it takes to get a working copy of the data back and who knows how to do it. If the answer is "nobody is sure", you have found the most useful thing in your plan.

Backups: offline and recent

On ransomware, the NCSC says to always have a recent offline backup of your most important files and data. It also warns that attackers may threaten to publish stolen data, so limiting the impact of data theft matters as well as restoring files. The NCSC and UK law enforcement do not encourage, endorse or condone paying ransom demands, and the NCSC notes that paying does not guarantee you get your data or computer back, the device stays infected, and you are more likely to be targeted again.

Who to call, and in what order

• Attack happening now: call 0300 123 2040. The NCSC says the line is open 24 hours a day, 7 days a week, and calls are prioritised and triaged over the phone. The report goes to the Report Fraud Analysis Service, which may pass it to a law enforcement agency.
• Significant attack: the NCSC recommends starting by reporting it at report.ncsc.gov.uk.
• Personal data involved: the GOV.UK reporting service says that information you give it is not shared with the Information Commissioner's Office, and that you may need to report separately to the ICO if there has been a breach of personal data. The ICO has a self-assessment tool to help you decide.

The NCSC defines a cyber incident broadly: unauthorised access, or attempted access, to your IT systems. That includes ransomware, malware, phishing and denial of service, but also accidental events such as fire, flood or theft. A laptop stolen from a van counts.

What to do this week

• List your critical few. Write down the three to five systems you could not trade without, who looks after each, and where the login details are kept offline.
• Print a one-page contact sheet. Include your IT provider, web host, payment provider, insurer and bank, plus the NCSC number above. Keep a paper copy. If email and shared drives are down, a document stored on them is no use.
• Check one backup by restoring from it. Make sure at least one copy is offline or otherwise out of reach of whoever is logged into your main systems.
• Decide who decides. Name one person with authority to shut systems down, call for help and speak to customers, and a deputy.
• Ask your suppliers. If a provider holds your data or runs your site, ask how they would tell you about an incident and how quickly you could be restored.
• Agree a customer message. A short, honest holding statement you can post or text is far easier to write calmly now than during an outage.

The wider picture

Infosecurity Magazine cited ManageEngine data that 77% of British organisations had a cyber incident in the past year, 11 percentage points above the European average, and noted the NCSC's warnings that AI is helping attackers move faster. The practical reading for a small firm is not alarm but preparation: the quicker you can act, the less you lose.

Recovery is also easier when your systems are built with it in mind: separate admin accounts, tested backups and clear ownership of domains and hosting. If you want help reviewing how your website, ordering system or cloud setup would cope, our cloud and security work covers exactly this. And do not forget the free NCSC resources: the Cyber Action Toolkit is aimed at sole traders and small businesses who want simple steps to protect themselves.

The NCSC's own page on highly disruptive attacks says that "some cyber risk will always remain". That is the honest starting point. You cannot make attack impossible, but you can decide in advance what you will do when it happens.