A Monday morning, the screens show a ransom demand, and nobody knows whom to call first. In that situation, the first few hours decide how large the damage becomes. Yet according to a BDO survey, only about a third of Swiss SMEs have a written emergency plan. In 2025 alone, 104 ransomware attacks were reported to the Federal Office for Cybersecurity (NCSC), and the real number is considerably higher.
A useful plan does not need 40 pages. The essentials can be gathered in an afternoon. What matters is that it exists, that the right people know it and that it can be reached when the IT is down.
1. Collect the contacts
In an emergency, the simplest things are often missing: phone numbers, customer numbers, contract numbers. Write down:
- your IT support with its emergency number
- management and a deputy
- your internet provider and software vendor with customer numbers
- your cyber insurer with policy number and emergency hotline, if you have one
- your bank, in case payments need to be stopped
- the NCSC for reporting the incident
2. Rank your systems
Not everything has to come back at once. Decide together what needs to be restored first. A simple list is enough, for example:
- Email and phone, so you stay reachable
- ERP and order processing
- File storage
- everything else
For each item, note how long an outage may last at most and how much data may be lost in the worst case. These two figures determine how your backup needs to be set up.
3. Write down the first steps
During an attack: disconnect devices from the network, but do not switch them off. A computer that is turned off loses traces in memory that matter for the analysis. Note the first steps in short sentences:
- unplug the network cable and turn off Wi-Fi
- call your IT support
- delete nothing, reinstall nothing
- do not respond to the ransom demand
- write down the time and what you observed
4. Assign responsibilities
Who decides whether operations are shut down? Who informs staff, who informs customers? Who reports the incident to the Federal Data Protection and Information Commissioner (FDPIC) if personal data is affected? Each of these questions needs a name and a deputy.
5. Keep the plan within reach
An emergency plan stored only on the encrypted server is useless. Print it and keep it in two places, for example at the office and at a manager’s home. A copy on your phone also makes sense.
6. Practise once a year
The best plan helps little if nobody knows it. Once a year, walk through a scenario: what do we do if the server will not start tomorrow? You will quickly see which number is out of date or which procedure does not work. Use the opportunity to check that the backup can really be restored.
Our support
We create the emergency plan with you, check your backups and run the exercise. How an attack typically unfolds is described in our article on encryption trojans. More under IT security and Backup.
Frequently asked questions
How detailed does an IT emergency plan need to be?
For an SME, two to five pages are usually enough. More important than length is that contacts, priorities and first steps are correct and that the plan exists on paper.
Do we have to report a cyberattack?
Operators of critical infrastructure must report cyberattacks to the NCSC within 24 hours. For everyone else, reporting is voluntary but recommended. If personal data is affected, a notification to the FDPIC may also be required.
Should we switch off the computer during an attack?
No. Disconnect the device from the network but leave it switched on. That way, traces that help the investigation are preserved.
How often should the plan be updated?
At least once a year and with every major change, such as a new server, a new software vendor or staff changes.
