Incident response

What it means

Incident response is a pre-prepared and tested procedure a company follows when hit by a cyberattack, data breach or other security incident. It sets out who declares the incident, who makes decisions, how damage is contained, how evidence is preserved and who must be informed.

A typical plan has several phases: detecting and assessing the incident, containing it, for example by disconnecting infected computers from the network, removing the cause, restoring systems from backups and finally reviewing what happened and what to improve. In a ransomware attack, speed in the first hours is decisive.

Incident response ties in with the business continuity plan, which covers how the company operates during an outage, and with the recovery targets RPO and RTO. For entities under the NIS2 directive, having such a procedure and reporting serious incidents within short deadlines is a legal obligation.

How it works in practice

Even for a small company we recommend at least a one-page procedure: phone numbers for the IT provider, management and insurer, a list of critical systems, where backups are kept, and what to do and not do in the first minutes. The document must be available offline when systems are down.

If the company has cyber insurance, the policy terms often require reporting the incident to the insurer immediately and using its crisis hotline and experts. Acting unilaterally, such as paying a ransom without consultation, can jeopardise the claim.

If personal data were affected, the controller assesses whether the incident must be reported to the Office for Personal Data Protection within a short statutory period from discovery. Where the risk is high, the individuals concerned must also be told. These steps should be described in the plan in advance.

What to watch out for

The most common mistake in the first minutes is switching off infected computers or reinstalling them straight away. That destroys the evidence needed to establish the scope of the attack and for the insurer or police. The right move is to disconnect the device from the network and leave it on until an expert decides.

A plan nobody has ever tested will fail in a crisis. Once a year it is enough to walk through a scenario such as “this morning every file is encrypted” and check that people know what to do and that backups really work. Such an exercise often reveals weaknesses that are cheap to fix.