A small accounting firm with 14 employees discovered their email system had been compromised. A client had received a fraudulent invoice from what appeared to be the firm's address. The owner had no incident response process, no contact for their hosting provider outside of a billing email, and no idea whether other clients had been affected.
The position they were starting from
No security retainer. No IT staff. One part-time contractor who managed their systems remotely. The breach had likely been active for 11 days before anyone noticed. Client data was potentially exposed, and legal obligations around notification were unclear.
Building a minimal but functional response structure
Working with a cybersecurity consultant over three weeks, they put together a response framework that fit their actual capacity:
- A one-page incident classification guide — is this a nuisance, a breach, or a crisis?
- Pre-written client notification templates approved by their legal advisor
- An emergency contact sheet with their hosting provider, domain registrar, and insurance contact — stored offline
- A basic log review checklist their contractor could run within the first hour of any suspected incident
What the after state looked like
Three months after implementation, a phishing attempt successfully captured one employee credential. Using the new process, the firm identified the compromise within 6 hours, revoked access, reviewed affected mailboxes, and sent a precautionary client notice — all within 24 hours.
That is not a perfect outcome, but it is a manageable one. For a 14-person firm, manageable is the realistic goal.