Most small teams spend nothing on incident response until the incident — then spend everything at once, in a panic, on the wrong things. The pattern is always the same: a Saturday outage, an emergency contractor, an invoice nobody expected, and a retrospective that says "we should have a budget for this." Then next quarter arrives and the budget line is still missing.
The honest IR budget for a team under twenty has five lines and one split: fund detection first, second copies second, on-call time third, practice fourth, transfer last. One bad afternoon funds the whole year.
Full template with the worked example: Incident Response Budget Template — HIVE80lab Ops Notes. It sits next to the severity matrix and the uptime/downtime budget — the labels decide what a response costs, the downtime arithmetic decides what it's worth funding.
1. The one-page IR budget card
One row per line item. If a row has no owner and no review date, it is a wish, not a budget line:
| Line item | What it buys | Annual band | Owner | Reviewed |
|---|---|---|---|---|
| Detection — monitors on what customers notice first | Uptime, DNS, SSL/cert expiry, backup-job success, form checks | $0–$600 | Named person | Quarterly |
| Second copies — the provider you fail over to | Second DNS provider, offsite backup storage, zone exports | $120–$900 | Named person | Quarterly |
| On-call time — the hours you're asking someone to give | Stipend, time-in-lieu, or a written rotation with comp rules | $0–$2,400 | Owner/ops lead | Quarterly |
| Practice — two tabletops + one restore drill a year | Half-days of team time, a facilitator, the drill log | $0–$1,000 | Named person | Quarterly |
| Transfer — insurance and legal readiness | Cyber insurance quote, notification-duty review, retainer review | $0–$1,500 | Owner | Annually |
Total band: roughly $120–$6,400 a year. The total matters less than the split — teams that skip detection to buy response tools own alerts that never fire and retainers they can't trigger.
2. The 40/30/20/10 split
- 40% detection. Small teams don't die from incidents; they die from late incidents. An outage caught by a monitor costs minutes; the same outage caught by a customer tweet costs the afternoon and the trust.
- 30% response. On-call time, the escalation policy, the runbooks people actually open at 2am.
- 20% recovery. Tested backups, a second provider, the restore drill that proves both work.
- 10% practice. Tabletops and drills. Always the first line cut — which is exactly why it's a line, not a leftover.
A team that spends 80% on tools and 0% on practice has bought equipment for a fire brigade that has never met.
3. The funding rule: one bad afternoon pays for the year
Don't benchmark against enterprise security budgets — benchmark against your own last incident. Set the annual IR budget at roughly what your last incident cost you (engineering hours × loaded rate, plus refunds, credits, churn, and the emergency invoice), then spend it before instead of after. If you've never measured the cost of an hour down, do that arithmetic first.
4. The spending ladder (in order, no skipping)
- Detection first ($0–$600). Monitors on the five signals customers hit first. Cheapest line, biggest return, everything downstream depends on it.
- Second copies second ($120–$900). A tested backup and a pre-configured second DNS/backup provider. An untested backup is a wish.
- Practice third (time, not money). Two tabletops and one restore drill a year — where the severity labels and runbooks get exercised before they're needed for real.
- Tooling last. Buy automation only after two drills found the same gap. A tool bought for a gap you haven't drilled is a guess with an invoice.
- Transfer when revenue justifies it. Cyber insurance and legal review after lines 1–3 exist. Insurers ask what you already do; "nothing" is the expensive answer.
5. What NOT to buy first
- A SIEM. Nobody under twenty people has the staff to read one. You need five monitors and one alert rule, not a log warehouse.
- An incident response retainer. Response firms bill for the response you can't yet trigger — without detection and tested backups, the retainer's first act is discovering what broke.
- EDR + 24/7 SOC bundles. Real value at 200+ seats. Before that it's monthly cost defending a house with no smoke alarms.
- The premium monitoring tier. The $600 plan monitors things nobody agreed to respond to. Write the escalation policy before raising the monitoring bill.
Every dollar of emergency spend during an incident is a budget line that was missing. That is the whole audit.
6. Three metrics
- MTTD, trending down. The budget's first job is shortening the time between "broken" and "known."
- Lines exercised %. The share of budget lines that fired in a real incident or a drill this quarter. A line never exercised is a line you're renting, not using.
- Emergency spend per incident. Target: $0. Panic invoices mean the budget didn't reach the line that mattered.
Worked example: $0 budget to $3,400 and calm
A twelve-person B2B SaaS (payments integrations) spent exactly $0 on IR and $2,100 one Saturday — an emergency contractor re-building DNS at 11pm while support answered tickets with a spreadsheet. A quarter later, a payment-processor API outage silently broke checkout for six hours before anyone noticed; the churn conversation that followed was pricier than the contractor.
They wrote the card: $3,400/year split 40/30/20/10 — $1,360 detection, $1,020 on-call (written rotation, time-in-lieu), $680 second copies, $340 practice. The next real incident — the same processor API flaking — was caught by the processor-health monitor in 90 seconds, first customer update out in 48 minutes, emergency spend $0. Same team, same vendors; the difference was $3,400 spent before instead of $2,100 spent after, plus the six silent hours they didn't have.
If you want the fillable version — the budget card plus the severity matrix and runbooks behind it — that's the Ops Starter Kit ($14); Vol. 2 ($27) adds the DR plan and evidence log, and the Mega Bundle is all five kits at one checkout. Score your IR readiness free in two minutes, no signup.
Top comments (0)