What to do when an attack succeeds?
Crisis management.
In an emergency, what counts is not who has the best technology, but who is prepared.
In 60 seconds
- Preparation beats improvisation: define roles, contacts and an emergency plan in advance.
- The first hours: alert the crisis team, isolate, document, check deadlines.
- Practise at least once a year: tabletop exercise and restore test.
Disruption or crisis?#
The difference
A disruption can be resolved in day-to-day operations. A crisis threatens the ability to act and requires decisions by management.
Preparation beats improvisation
Roles, contact lists and first steps are defined in advance. Otherwise decisions under stress are worse.
Communication is half the battle
Employees, customers, authorities and the media need clear, coordinated information.
4 phases.#
From the emergency manual to the follow-up.
Prepare
Emergency manual, roles, contact lists, tested backups and regular exercises.
Detect and assess
Alerting, first situation report and classification: disruption or crisis?
Handle
Contain, secure evidence, communicate and steer recovery by priority.
Follow up
What went well, what did not? Derive measures and complete reports.
Who does what?#
In the crisis team, roles are clearly assigned, each with a deputy.
Head of the crisis team
Usually the management. Makes decisions and releases resources.
Technical lead
Coordinates analysis, containment and recovery in IT.
Communication
Informs internally and externally, coordinates texts and handles press relations.
Legal and data protection
Checks reporting obligations and deadlines, such as NIS2 and GDPR.
Departments and HR
Name critical processes and organise emergency operations.
External support
Incident response providers, forensics, insurers and authorities. Clarify contacts in advance.
The first hours.#
A checklist for the moment it happens.
- Stay calm. Alert the crisis team and fill the roles.
- Disconnect affected systems from the network. If possible, do not switch them off immediately, so that evidence is preserved.
- Protect backups. Disconnect backups from the network before they are reached.
- Document everything. Keep a timeline: who did what and when?
- Check reporting obligations. Deadlines run from the moment you become aware of the incident.
- Bring in experts. Involve forensics and incident response early.
Practise before it counts.#
A plan is only good once it has been played through.
Tabletop exercise
Management and IT play through a scenario at the table, for example ransomware on a Friday evening. 2 hours are enough to start.
Technical test
A restore from backup under real conditions: how long does it really take?
Alert chain
Can everyone be reached, even at night? Check contact lists and deputies.
Backup planner.#
How long does recovery take, and does that match your goal?
Rough guidance, no audit and no legal advice. Your selection stays in your browser.
Check: crisis readiness.#
6 questions for your company.
Rough guidance, no audit and no legal advice. Your selection stays in your browser.
Frequently asked questions.#
Do I really need an emergency manual?
Yes. It does not have to be thick. What matters are roles, contacts, first steps and priorities. It must also be available when systems fail, for example printed.
Should you pay a ransom?
Authorities generally advise against it, because there is no guarantee of recovery and it finances the attackers. The decision belongs in the crisis team, with legal advice and involving law enforcement.
What does cyber insurance offer?
It can cushion costs and give access to experts. However, insurers set requirements for security measures and reporting channels that must be met in advance.
What are RTO and RPO?
RTO is the maximum time a system may be down. RPO describes how much data loss, measured in time, is still acceptable. Both determine backup and recovery concepts.
Think through an emergency plan together?
Tell me where you want to start, and we will add to the content.