UpTrajectory Review

Harpreet Sidhu's piece in Harvard Business Review argues that most companies invest heavily in preventing cyberattacks but leave the critical first three days after a breach dangerously unplanned. The article outlines five steps to ensure your core operations can restart quickly. While the full text is behind HBR's paywall, the framing alone carries weight: the question is no longer if an incident happens, but whether your business can function while it unfolds. For small operators, this distinction matters enormously because you rarely have a dedicated incident response team sitting idle.

If you run a small business, a cyberattack is not an IT problem. It is a cash-flow problem, a customer-trust problem, and often a legal problem, all arriving at once. The first 72 hours determine whether you look like a competent operator who hit a rough patch or a careless one who lost client data. Your customers will not remember the firewall you bought. They will remember whether you could still take their order, answer their email, and tell them honestly what happened.

The emphasis on a short, concrete time window is what makes this piece worth reading rather than another generic checklist. Many security guides speak in frameworks and maturity models. A 72-hour plan forces you to name specific things: who calls the bank, who talks to customers, what systems you can run offline, and what you absolutely will not do, like paying a ransom without advice. That kind of operational clarity is rare in security writing and genuinely useful.

The harder truth is that most small businesses cannot execute a polished five-step plan under stress. Your office manager is also your incident coordinator. Your backup may be three days old. Your cyber insurance policy may require a specific breach-response vendor you have never called. The real value of Sidhu's framework is not the steps themselves but the discipline of deciding these things before you are panicking and your phones are ringing.

Start this week by writing a one-page plan on paper, not in a file on the server you might lose. List your three most critical systems, the person who can shut them down or restore them, and the phone number of one outside expert you can call at 2 a.m. Then test one restore. If you cannot bring back a single critical file or system in under a day, your backup strategy is a hope, not a plan.

Watch for two things in the coming year. First, whether your cyber insurance carrier tightens requirements around documented response plans, because carriers are increasingly refusing claims when companies cannot show preparation. Second, whether your largest clients start sending security questionnaires that ask specifically about incident response, not just prevention. The operators who can answer those questions specifically will keep the contracts.

“Five steps to ensure the core of your business can get back up and running.” — Harvard Business Review

Takeaway: Write a one-page, 72-hour cyberattack response plan today and test one system restore this week.