November 4, 2026

Your IT Company Fixes the Systems. Who Handles the Breach?

Small business data breach response roles split between an IT provider and a firm owner on the phone

A small business data breach response usually starts with one phone call: “Get our IT company on the line.” That is the right first call. It is also where many firms stop planning. Your IT provider can work on the systems. Someone at your firm still has to decide who gets told, what they hear, and when.

Last Updated: November 2026

This small business post-breach playbook is for owners, principals, and operations leads at firms with no full-time security leader. That includes independent insurance agencies, tax and accounting firms, and mortgage brokers and lenders. It separates the work IT does from the work that stays with your firm. It also gives you the questions to ask your provider before you need the answers.

Key takeaways

Your IT company is the right owner for containment, evidence, and recovery of your systems.
Reporting decisions, regulators, clients, employees, and records usually stay with your firm.
Outsourcing security work does not outsource responsibility. The FTC and the NAIC model law both point back to the business.
A one-page small business data breach response plan should name who owns each decision, with a backup.

What your IT company handles in a small business data breach response

A good IT provider earns its fee in the first hours. Most of this work belongs with them, or with a forensic firm they help you bring in:

Containing the attack. The FTC’s breach response guide says to take affected equipment offline right away, but to leave machines on until forensic experts arrive.
Securing accounts. Stolen credentials keep working until someone changes them, even after the attacker’s tools are gone.
Preserving evidence. Logs and affected devices need to stay intact. Wiping a laptop can erase the record of what happened.
Finding the way in. Your provider can help trace the entry point. Serious events may also call for independent forensic investigators.
Restoring operations. Backups, clean machines, and fixes to the weakness that let the attacker in.

Scope varies by contract, and some providers offer more than this list. Even so, the FTC treats IT as one seat at the table. Its guide lists forensics, legal, information security, IT, operations, human resources, communications, and management as possible members of a response team.

What stays with your firm in a small business data breach response

IT can tell you what the attacker touched. It usually cannot tell you what that means for your clients or your license. These jobs tend to land on the owner’s desk:

Deciding whether it is reportable. IT supplies the facts. Whether those facts trigger a legal duty is a legal question.
Knowing which rules apply. That depends on your activities, your regulator, your contracts, and where affected people live.
Telling regulators. A commissioner, the FTC, or a state attorney general expects to hear from your firm.
Telling clients, carriers, and lenders. Those relationships are yours, and so is the wording.
Supporting employees. Staff records often sit in the same systems as client files.
Keeping the record. Someone has to document the timeline, the decisions, and the follow-up.

These jobs sit on top of the technical cost. Verizon’s 2026 Breach Impact Study reviewed U.S. cyber insurance claims. For businesses under $25 million in revenue, the median impact was about $38,000, and Verizon says its loss figures “should be read as floors rather than ceilings.” Response and recovery, which covers incident response and data restoration, made up 40% of known losses for that group.

Why data breach response rules point back to your firm

The rules below shape a small business data breach response, but they do not apply to every firm in the same way. Coverage depends on your activities, size, state, and regulator, so confirm your own position with counsel.

Tax firms and mortgage companies

The FTC Safeguards Rule covers non-bank financial institutions under FTC jurisdiction. The FTC lists tax preparation firms, mortgage lenders, and mortgage brokers among its examples. The rule requires a Qualified Individual to run the security program, and that person can work for a service provider. Your IT company could fill that role. The FTC’s guidance is blunt about what happens next: “the buck still stops with you.” Your firm must still name a senior employee to supervise that person.

Covered firms must also notify the FTC within 30 days of discovering a breach involving the unencrypted information of at least 500 consumers. Firms with customer information on fewer than 5,000 consumers are exempt from certain provisions, so check the rule against your own count. Our tax firm data breach response plan walks through the full call list for tax practices.

Independent insurance agencies

Many states have adopted a version of the NAIC Insurance Data Security Model Law, and those versions differ. The model lets an outside vendor carry out investigation work. If the event happens on a vendor’s system, the licensee must complete the investigation steps or confirm and document that the vendor did. The 72-hour commissioner notice runs from the agency’s determination. Our insurance agency incident response plan covers those deadlines in detail.

Every firm: state breach notification laws

The FTC notes that every state has a breach notification law. The Privacy Rights Clearinghouse 2026 survey, which reflects statutes as of January 1, 2026, found numeric consumer deadlines in 20 states. Five of those sit at 30 days: California, Colorado, Florida, New York, and Washington. It also found that 36 states require a report to the attorney general or another state agency.

One more point matters here. Your IT company is itself a vendor. Verizon’s 2026 DBIR found that third parties were involved in 48% of breaches, up 60% in a year. If the provider gets hit, you may be the one making the calls. Our third-party data breach guide covers that scenario.

Five questions to ask your IT company this week

None of these questions challenges your provider. A good one will welcome them, because the same confusion hurts them too.

What does our contract cover during a security incident? Ask what is included, what is billed separately, and what is out of scope.
Who do you call at our firm, and when? Get a named contact, a backup, and an after-hours number on both sides.
How will you tell us what data was involved? Ask how fast you would get an answer, and in what form.
What evidence will you keep, and for how long? Regulators and investigators may ask for it later.
How fast will you notify us if you are breached? Under the NAIC model, for example, an agency’s deadline starts the day after the vendor notifies it or it otherwise learns of the event, whichever comes first.

If an answer surprises you, that is useful. Better to find the gap in November than during an incident.

Build a one-page small business data breach response plan

You do not need a binder. You need a page that names who owns what, with phone numbers that work after hours.

Decision owner, plus a backup. This person declares an incident and makes the final calls.
Technical lead. Usually your IT company or internal IT contact.
Legal contact. Counsel with privacy and data security experience, or a breach response team that can bring one in.
Communications lead. The FTC recommends a single point person for releasing information.
Employee lead. Whoever will answer staff questions when their records are involved.
Record keeper. One person logs what happened, when, and who decided what.

Both the Safeguards Rule and the NAIC model expect clear roles and levels of decision-making authority in a written incident response plan, for firms those rules cover. Check your cyber insurance policy too, since many policies set notice terms and name approved vendors. Add those contacts to the page, and keep a paper copy in case your network is locked.

Then test your small business data breach response plan. Invite your IT provider to a 45-minute tabletop exercise. Read one scenario aloud, such as a client calling about wire instructions your office never sent. Walk through who does what. Every gap you find now is one you will not find during a real event.

A small business data breach response when roles are clear

Timelines differ by rule and by event, but a clear division of labor tends to look like this.

The first hours

Whoever spots the problem calls the decision owner. IT contains the damage and preserves evidence while the record keeper starts a log. The decision owner calls legal support and checks the insurance policy for notice terms.

The first day

IT and any forensic help work out what happened and what data was involved. Legal support helps determine whether it is a reportable breach, and under which laws. Nobody tells a client that “no data was affected” until the facts support it. The FTC warns against misleading statements about a breach.

The first three days

The firm sends any notices that are due, starting with the shortest deadline. For a licensed agency under a model-based law, that may be the commissioner. First notices do not always need every answer, and some rules let you update later. Check what yours allows.

After the crisis

IT closes the gap. The firm finishes client and employee communication, files its records, and holds a short review. What slowed you down? Update the page while the lessons are fresh.

Don’t forget your employees

A small business data breach response often focuses on client data and overlooks payroll and HR files. If employee Social Security numbers were exposed, your staff face the same risks as your clients. The FTC suggests considering at least a year of free credit monitoring or identity restoration support when financial information or Social Security numbers are exposed. The Privacy Rights Clearinghouse survey found that six states require free credit monitoring. Plan for this before you need it, because your staff will ask on day one.

Frequently asked questions

Does my IT company handle the data breach response?

In a small business data breach response, your IT company typically handles the technical work, such as containment, evidence, and recovery. Scope depends on your contract. Decisions about legal duties, regulators, clients, and employees usually stay with your firm.

Who is responsible if our IT provider gets breached?

It depends on the rules and contracts that apply to you. Under the NAIC model, an agency treats a vendor event much like its own. Under the FTC Safeguards Rule, covered firms must oversee their service providers. Ask counsel about your own position.

Can our IT company be our Qualified Individual?

Under the FTC Safeguards Rule, the Qualified Individual can work for a service provider. Your firm keeps responsibility and must designate a senior employee to supervise that person. The provider must also maintain a security program that protects your business.

What should a small business data breach response plan include?

It should name a decision owner and backup, a technical lead, a legal contact, a communications lead, an employee lead, and a record keeper. Add a call list, your insurance notice terms, and your notification deadlines.

How fast do we have to notify people after a breach?

It depends on your regulator and where affected people live. A 2026 survey found numeric consumer deadlines of 30 to 60 days in 20 states. Other states use language such as “without unreasonable delay.” Regulator deadlines can be much shorter.

What is the first step in a data breach response?

Call your decision owner and your IT provider. Take affected equipment offline, but leave machines on until forensic experts arrive. Do not delete anything, and start a written log of what you saw and when.

Keep your IT company. Cover the rest.

Your IT company should keep running your systems. defend-id works alongside it on the parts that land on your desk. When something goes wrong, you can reach our 24/7 incident response and breach support team. The team helps determine whether an incident is a breach, then lays out the notification requirements that apply by jurisdiction. If reporting is required and you engage Jackson Lewis, our breach response law firm partner, initial reporting comes at no extra cost, with reduced rates after that. The platform also includes Legal Protection for Business, staff training, vendor management, and identity recovery for your employees. Your firm remains responsible for its own program and obligations. Want to see how your small business data breach response would hold up? Talk with our team at defend-id.

Sources: FTC Safeguards Rule: What Your Business Needs to Know; FTC Data Breach Response: A Guide for Business; NAIC Insurance Data Security Model Law; Verizon 2026 DBIR and 2026 Breach Impact Study; Privacy Rights Clearinghouse 2026 survey. This article is general information, not legal advice. Requirements depend on your firm’s activities, size, and states of operation.