An incident response plan (IRP) is a documented procedure that guides North Carolina businesses through detecting, containing, eradicating, and recovering from cybersecurity incidents. Without an IRP, organizations take an average of 241 days to identify and contain a breach, costing $1.39 million more than organizations with faster response capabilities.
Key takeaway: According to IBM's 2025 Cost of a Data Breach Report, organizations using AI and automated detection cut response times by roughly 80 days and saved approximately $1.9 million per breach. Meanwhile, 60% of small businesses go out of business within six months of a cyberattack, making incident response planning essential for survival.
Need help building your incident response plan? Preferred Data Corporation provides cybersecurity services and managed IT including incident response planning for North Carolina businesses. BBB A+ rated with 37+ years of experience. Call (336) 886-3282 or schedule your consultation.
Why NC Small Businesses Need an Incident Response Plan
The threat landscape for North Carolina small businesses is severe:
- Ransomware was present in 44% of all data breaches in 2025, up from 32% in 2024, impacting smaller organizations more than larger ones
- Small and medium businesses face an average breach cost of $2.98-$3.31 million
- Breach notifications surged 312% in the U.S. in 2024
- 36% of breaches originated from third-party compromises, up 6.5% year-over-year
For Piedmont Triad manufacturers, Charlotte professional services firms, and Greensboro businesses, an IRP is not optional. It is the difference between managed recovery and business failure.
The NIST Incident Response Framework
The National Institute of Standards and Technology (NIST) SP 800-61 provides the standard framework for incident response, organized into six phases.
Phase 1: Preparation
Preparation is everything you do before an incident occurs. For High Point, Winston-Salem, and Raleigh businesses, this phase determines how effectively you respond when the inevitable happens.
Incident Response Team Roles
Define who does what during an incident:
Incident Commander (typically CEO/Owner or IT Director):
- Makes critical decisions (pay ransom vs. rebuild, notify customers, engage legal)
- Authorizes spending and resource allocation
- Communicates with board, investors, and executives
- Final approval on public communications
Technical Lead (IT Manager or MSP):
- Leads technical investigation and containment
- Coordinates with cybersecurity specialists
- Manages evidence preservation
- Directs recovery operations
Communications Lead (Marketing/PR or designated person):
- Manages internal employee communications
- Handles media inquiries
- Coordinates customer notifications
- Manages social media presence during incidents
Legal Counsel (attorney with cyber experience):
- Advises on NC breach notification obligations (GS 75-65)
- Manages regulatory communications
- Preserves attorney-client privilege over investigation
- Reviews public statements
External Resources (pre-arranged relationships):
- Managed IT security provider (24/7 response)
- Cyber insurance carrier (claim notification procedures)
- Forensic investigation firm
- FBI/CISA contacts for federal reporting
Communication Plan
Pre-define communication channels and templates:
- Internal notification chain: Who is called first, second, third
- After-hours contacts: Personal cell phones for key personnel
- Alternative communication: If email is compromised, use phone/text/Signal
- Customer notification templates: Pre-drafted language for common scenarios
- Vendor notification list: Critical partners who need to know
- Media statement template: Holding statement ready for press inquiries
Technical Preparation
- [ ] Deploy endpoint detection and response (EDR) on all devices
- [ ] Maintain current network diagrams and asset inventory
- [ ] Implement centralized logging (SIEM or log management)
- [ ] Maintain offline backups tested monthly
- [ ] Document all administrative credentials in secure offline vault
- [ ] Pre-authorize emergency spending limits for incident response
- [ ] Establish forensic image capability (or pre-contract with forensic firm)
Phase 2: Identification
Detecting that an incident has occurred and determining its scope.
Detection Sources
Monitor these channels for incident indicators:
- Security alerts: EDR, firewall, SIEM, and email security alerts
- User reports: Employees reporting suspicious emails, slow systems, or unusual behavior
- Vendor notifications: ISP, cloud provider, or partner reports of anomalous activity
- External reports: Customer complaints, law enforcement notifications, media inquiries
- Automated monitoring: Unusual data transfers, login patterns, or system changes
Initial Assessment Questions
When a potential incident is detected:
- What systems are affected? (scope)
- What type of incident is this? (ransomware, data theft, unauthorized access, etc.)
- When did it start? (timeline)
- Is the attack still active? (urgency)
- What data is potentially exposed? (impact)
- Are production systems affected? (business continuity)
Severity Classification
Critical (respond immediately):
- Active ransomware encryption in progress
- Confirmed data exfiltration of customer/employee PII
- Production systems compromised (manufacturing, critical business operations)
- Active attacker presence with administrative access
High (respond within 1 hour):
- Multiple systems compromised but contained
- Potential data exposure under investigation
- Business email compromise with financial transaction risk
- Credential theft affecting privileged accounts
Medium (respond within 4 hours):
- Single system compromise without lateral movement
- Phishing success without confirmed data access
- Malware detection on endpoint (quarantined)
- Unauthorized access attempt (blocked)
Low (respond within 24 hours):
- Failed attack attempts
- Policy violations without security impact
- Vulnerability discovered (not yet exploited)
- Suspicious activity requiring investigation
Phase 3: Containment
Stop the bleeding without destroying evidence.
Short-Term Containment (First Hours)
Immediate actions to stop the spread:
- Isolate affected systems from the network (disconnect, not power off)
- Block attacker IP addresses at the firewall
- Disable compromised accounts in Active Directory/cloud identity
- Preserve evidence by imaging affected systems before changes
- Activate backup communications if primary email is compromised
- Notify cyber insurance carrier (most require notification within 24-72 hours)
Long-Term Containment (Days 1-3)
Establish stable operations while investigation continues:
- Segment the network to isolate affected areas from clean systems
- Apply emergency patches to vulnerabilities being exploited
- Reset credentials for all potentially compromised accounts
- Deploy additional monitoring on remaining systems
- Establish clean communication channels for response team
- Brief employees on temporary procedures and restrictions
Under attack right now? PDC provides emergency cybersecurity response for North Carolina businesses. Call (336) 886-3282 immediately for 24/7 incident support.
Phase 4: Eradication
Remove the threat completely from your environment.
Root Cause Identification
Determine how the attacker got in:
- Phishing email that delivered malware or captured credentials
- Exploited vulnerability in internet-facing systems
- Compromised credentials from password reuse or dark web exposure
- Third-party breach providing access through vendor connections
- Insider threat from current or former employee
Removal Actions
- Remove all malware, backdoors, and attacker tools
- Close the entry point used for initial access
- Patch all exploited vulnerabilities
- Remove unauthorized accounts created by attackers
- Rebuild compromised systems from clean images
- Verify integrity of backup data before restoration
Phase 5: Recovery
Restore normal operations safely and methodically.
Recovery Sequence
- Validate clean systems before reconnecting to network
- Restore from verified clean backups (test integrity before trusting)
- Monitor recovered systems intensively for signs of persistent access
- Gradually restore services starting with least critical
- Validate data integrity across restored systems
- Resume normal operations with enhanced monitoring for 30+ days
- Confirm all user credentials are reset and MFA enforced
Business Continuity
During recovery, maintain operations through:
- Manual processes for critical workflows
- Alternative systems or cloud-based temporary tools
- Customer communication about service status
- Employee guidance on interim procedures
Phase 6: Lessons Learned
After recovery, improve your defenses.
Post-Incident Review (Within 2 Weeks)
Conduct a formal review addressing:
- What happened and how did the attacker succeed?
- When was the incident detected and by what mechanism?
- What worked well in the response?
- What gaps or delays occurred?
- What would we do differently next time?
- What investments are needed to prevent recurrence?
Documentation and Improvement
- Update the IRP based on lessons learned
- Implement technical controls addressing root cause
- Conduct additional training for identified gaps
- Brief leadership on findings and recommendations
- Schedule follow-up testing (penetration test, tabletop exercise)
North Carolina Breach Notification Requirements
NC General Statute 75-65 requires specific actions when personal information is compromised.
Who Must Comply
Any business that owns, licenses, or maintains personal information of North Carolina residents must comply.
Notification Timing
Notice must be provided "without unreasonable delay," consistent with law enforcement needs and the time necessary to determine the scope of the breach. While NC does not specify exact days, the trend nationally is toward 30-day notification deadlines (California and New York adopted 30-day requirements in 2024).
Required Notification Content
Your breach notification must include:
- Description of the incident in general terms
- Types of personal information compromised
- Steps taken to protect information from further access
- Contact telephone number for questions
- Advice to remain vigilant (review statements, monitor credit)
- FTC and NC Attorney General contact information
Attorney General Notification
You must notify the NC Consumer Protection Division about:
- Nature of the breach
- Number of consumers affected
- Steps taken to investigate
- Steps to prevent future breaches
- Timing and content of consumer notice
Breaches Affecting 1,000+ People
If notifying more than 1,000 people, you must also notify all nationwide consumer reporting agencies (Equifax, Experian, TransUnion).
Incident Response Plan Checklist
Use this checklist to build your IRP:
- [ ] Defined incident response team with roles and contact information
- [ ] Classified incident severity levels with response timeframes
- [ ] Documented communication plan (internal, external, media, regulatory)
- [ ] Pre-arranged relationships with legal, forensic, and insurance resources
- [ ] Technical preparation (EDR, logging, backups, asset inventory)
- [ ] Containment procedures for common incident types
- [ ] Evidence preservation procedures documented
- [ ] Recovery procedures including backup restoration steps
- [ ] NC breach notification procedures and templates
- [ ] Lessons learned process and IRP update schedule
- [ ] Annual tabletop exercise to test the plan
- [ ] Employee training on incident reporting procedures
Why NC Businesses Trust PDC for Incident Response
Preferred Data Corporation has protected North Carolina businesses since 1987, providing cybersecurity services, managed IT, and data protection from our High Point headquarters.
PDC's incident response capabilities:
- 24/7 security monitoring detecting threats before they become incidents
- Incident response coordination managing containment through recovery
- Backup and recovery ensuring data is available for restoration
- Forensic investigation support with qualified partners
- NC breach notification guidance including legal coordination
- Post-incident hardening preventing recurrence
- On-site response within 200 miles of High Point
- BBB A+ rated with 20+ year average client retention
Ready to build your incident response plan? Contact Preferred Data Corporation for a free incident response readiness assessment. Call (336) 886-3282 or visit pdcsoftware.com/contact.
Frequently Asked Questions
How often should we test our incident response plan?
Conduct tabletop exercises at least annually, with targeted scenario walkthroughs quarterly. Tabletop exercises present hypothetical scenarios and walk through response procedures without actually performing technical actions. Full simulation exercises (actually executing containment procedures in a test environment) should occur every 1-2 years. Update the plan whenever significant technology or personnel changes occur.
What should we do in the first 15 minutes of a suspected breach?
First, do not panic or make hasty decisions. Immediately contact your IT security provider or incident commander. Isolate suspected systems by disconnecting from the network (do not power off, as this destroys volatile evidence). Document what you observe. Do not communicate about the incident over potentially compromised channels. Activate your pre-defined communication plan using alternative channels if needed.
Do we need cyber insurance before creating an IRP?
Both are essential and complementary. Cyber insurance provides financial protection, while an IRP ensures effective operational response. Most cyber insurance policies now require having an IRP as a policy condition. Additionally, insurers often provide incident response resources (forensic firms, legal counsel, notification services) as part of coverage. Obtain insurance and create your IRP concurrently.
What is the difference between an IRP and a disaster recovery plan?
An IRP specifically addresses security incidents (breaches, ransomware, unauthorized access) and includes investigation, evidence preservation, and regulatory notification. A disaster recovery plan addresses broader business continuity scenarios (natural disasters, hardware failures, facility loss). They overlap in the recovery phase but serve different purposes. NC businesses need both documents.
How does North Carolina's breach notification law compare to other states?
NC's GS 75-65 requires notification "without unreasonable delay" but does not specify exact days, unlike states that mandate 30, 45, or 60-day deadlines. NC requires notification to affected individuals and the Attorney General, with additional consumer reporting agency notification for breaches affecting 1,000+ people. The national trend is toward shorter deadlines (California and New York adopted 30-day requirements in 2024), so NC businesses should aim for 30-day notification as a best practice.