Incident response plan IRP
A written, rehearsed plan for what to do in the first hours and days of a security incident — who's notified, who decides what, and in what order.
For small firms
Writing this down before an incident, not during one, is the difference between a controlled response and chaos.