What should a small business do immediately after an employee clicks a phishing link?

Question

An employee clicked a convincing email link and entered their work password before realizing something was wrong. The company changed the password, but the owner is unsure whether that is enough. I need a clear first-response checklist that a small business can follow without a dedicated security team.