Does a small business need an incident-response plan?

Yes - but for a small business an incident-response plan is a one-page document, not a corporate binder: it is simply the list of who does what in the first hours after something goes wrong, written down before you need it:

• Who to call - your IT support, your bank, your key staff, and your insurer, with phone numbers that work when email is down.
• What to do first - disconnect the affected device, change the relevant passwords, and stop any in-progress payment.
• Who to notify - customers, and the OAIC if the breach is reportable under the Notifiable Data Breaches scheme.
• Where the backups are - how to restore from backup and who knows how to do it.

The value of an incident-response plan is making the decisions calmly in advance - write the one page now, while nothing is on fire.