Decision Rights Under Pressure: A One-Page Cyber Call Tree for UK Small Firms

Most UK small firms now hold backups, endpoint protection and a support contract. Fewer hold an agreed order of calls for the morning someone says the file server is behaving strangely. The gap is not technical. It is procedural. When a suspected cyber incident arrives, the first hour is often spent deciding who should decide.

A contact list is not a call tree

A contact list tells you who exists. A call tree tells you who acts, in what order, and on whose authority. The difference matters when an employee is faced with a locked screen, a fraudulent bank request or a message from a customer saying their data has appeared online.

The call tree should fit on one side of A4. It should begin with a simple trigger statement: any member of staff who suspects a cyber incident routes the matter to the named Incident Lead and does not attempt a repair. It should end with a decision record. Between those two points, it should show the sequence of calls, the decisions each role can take and the points at which external parties are engaged.

Five duties on one page

A workable call tree assigns duties rather than job titles. In a small firm, one person may hold two duties, but the page should still name a deputy for each. The aim is not bureaucracy. It is to prevent the managing director from becoming the single point of failure while also trying to run payroll.

• Incident Lead. Holds the authority to declare a suspected incident, convene the response and make the initial containment decision. This person should be senior enough to stop normal operations if needed, and calm enough not to do so reflexively.
• Technical Custodian. Coordinates the IT provider or internal technician, preserves evidence and recommends the least destructive containment step. This role should not also be responsible for customer communications.
• Business Liaison. Assesses the operational impact: which services have stopped, which deadlines are at risk and which staff need to be moved to manual workarounds.
• Insurance and Communications Lead. Calls the broker or insurer, manages the relationship with legal advisers and prepares the internal and external messages. This person also owns the ICO decision record.
• Scribe. Keeps a timed log of what was known, what was decided and why. In a very small firm, the Incident Lead may keep this log, but only if the log is kept contemporaneously.

The first 90 minutes in sequence

The call tree should not attempt to solve the incident. It should impose order on the first 90 minutes.

0-10 minutes: stop, note and preserve. The person who notices the problem should record the time, the system affected, any error message and the action already taken. They should not power down a machine, delete an email or run a clean-up tool unless the Technical Custodian advises it. Volatile evidence can disappear quickly.

10-20 minutes: declare and convene. The Incident Lead confirms that the matter is being treated as a suspected incident, opens the log and contacts the Technical Custodian and the IT provider. Calls should use mobile numbers, not the corporate email system, which may itself be compromised.

20-40 minutes: contain with care. The Technical Custodian recommends the least destructive action: isolating a network segment, disabling a single account, blocking a sender or domain, or resetting credentials after evidence has been captured. The Scribe records what changed and when.

40-60 minutes: assess the business and call the insurer. The Business Liaison identifies critical services and manual workarounds. The Insurance and Communications Lead calls the broker or insurer with the policy number, a short timeline and the actions taken so far. Early notification is usually sensible, even before the full picture is clear.

60-90 minutes: decide on external reporting. The team decides whether to notify the ICO, the National Cyber Security Centre, Action Fraud or legal advisers. The decision, and the reasons for it, should be written into the log. The 72-hour clock for reportable personal data breaches should not be allowed to run unmanaged.

The insurer call: early, but in the right order

Many UK SMEs have cyber cover without knowing what it requires in the first hour. The call tree should prompt the Insurance and Communications Lead to check the policy for notification deadlines, approved forensic providers and any requirement to use a panel solicitor. Engaging an unapproved vendor can complicate a claim. The broker should be called before a major spend is authorised, not after.

Evidence before repair

A recurring mistake is to wipe and rebuild the affected device before anyone has captured the logs. The call tree should state plainly that preservation comes before repair. Relevant evidence may include endpoint logs, email headers, cloud audit trails, firewall records, screenshots with timestamps and the affected device itself. Where practical, the Technical Custodian should record a hash of captured files and keep a simple chain-of-custody note. If legal advice is being taken, the firm should ask the solicitor how to preserve confidentiality over the investigation.

The ICO question is a judgement, not a reflex

Not every cyber incident is reportable to the Information Commissioner's Office. The trigger is a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. The firm must report without undue delay and, where feasible, within 72 hours of becoming aware. It should not wait for a full forensic report before making an initial assessment. If the position is unclear, the Incident Lead should record the uncertainty, take advice and note the decision. A short, dated rationale is better than a silent assumption.

A 90-minute tabletop to test the page

A call tree that has never been exercised is a hope, not a control. A 90-minute tabletop can be run in a meeting room with the people named on the page.

• 0-10 minutes: brief the team and read the trigger statement aloud.
• 10-35 minutes: inject a suspected ransomware attack on a shared drive. Ask each role to make the calls in sequence. Test the out-of-hours numbers and the deputy list.
• 35-55 minutes: inject a second problem, such as a fraudulent payment request or a lost laptop containing customer data. Ask the team to preserve evidence while keeping the business running.
• 55-75 minutes: test the insurer call and the ICO decision. Give the team an incomplete picture, as a real incident would.
• 75-90 minutes: debrief. Record gaps, assign owners and set dates for correction.

Run the exercise at least twice a year, and repeat it after a change of IT provider, insurance renewal or senior staff departure. Invite the broker to one session if they are willing. The point is not to score performance. It is to find the missing number, the absent deputy and the decision that no one had the authority to make.

Keep the page usable

Review the call tree quarterly. Print wallet cards for senior staff and keep an offline copy that does not depend on the email system. Test the numbers. Record the version date on the page. A one-page call tree will not prevent a cyber incident, but it can stop the first hour from becoming an argument. In a small firm, that is a meaningful control.