Decide how you will respond before you need to
Every organisation will face an incident; the difference is whether it is handled calmly or in chaos. A written incident response plan, understood and rehearsed, turns a crisis into a managed process. Base it on an established lifecycle: prepare, detect and analyse, contain and eradicate, recover, and learn.
Build the plan
Name an incident lead and a response team, with clear roles, authority and deputies for out-of-hours cover.
List how incidents are detected and reported, and the criteria for declaring one.
Keep an up-to-date contact list: leadership, IT and security providers, legal, communications, the relevant national authority, and law enforcement.
Store the plan and key contacts offline, so they remain available if systems are down.
When an incident is underway
Contain the damage, isolate affected systems, and preserve evidence and logs rather than wiping immediately.
Assess what is affected, including personal data, and whether services must be suspended.
Communicate with leadership and, where required, affected people and regulators, using prepared holding statements.
Report to the relevant national authority, and report qualifying personal-data breaches to the Office of the Data Protection Commissioner within the statutory timeline.
Recover from trusted backups, verify systems are clean, and restore services in a planned order.
Rehearse and improve
Run tabletop exercises so the team practises decisions under pressure, and confirm your backups actually restore. After any incident or exercise, hold a blameless review and fix the root causes, not just the symptoms. Each cycle should make the next response faster.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.