Responding to Cyber Incidents

A significant share of UK organizations experience cyber incidents, yet many remain unprepared to respond effectively when prevention fails. Cyber criminals collaborate and use tools such as ransomware and social engineering to steal intellectual property and personal data, enabling blackmail and fraudulent payments. Despite widespread deployment of preventative technologies, the lack of a formal incident response plan increases operational, legal, financial, and reputational risk—ranging from delayed understanding of what happened and which data was affected, to overwhelmed help desks, regulatory penalties, costly external forensics and recovery, and public-facing executive scrutiny.

Effective incident response must be prepared and tested in advance and scaled to incident severity. Many incidents can be handled within IT security, but major incidents—those that threaten the organization’s wellbeing, regulatory compliance, or safety of employees, customers, or the public—require board-level speed and authority, often bypassing normal processes. A complete response capability includes detection from help desks, SIEM, and external signals (press, law enforcement, social media), followed by triage using a clear severity scale (Red/Amber/Yellow) and a 24x7 mechanism to invoke major incident response.

Successful response depends on cross-functional participation clarified through RACI roles, spanning CISO accountability, process ownership, technical investigation, legal/privacy obligations, PR, business managers, IT operations, and external specialists. For major incidents, a predefined command structure (Gold-Silver-Bronze) improves decision-making and execution. Core operational phases include containment (limiting spread while balancing business impact), eradication (removing malware, closing vulnerabilities, preserving evidence), restoration (validating systems are clean before resuming), communications (internal “leader’s intent” plus managed media/customer messaging), formal notifications (including GDPR timelines), and post-incident review to drive improvements.

• Over four in ten businesses (43%) and two in ten charities (19%) experienced a cyber security breach or attack in the last 12 months.
• While 90% of businesses had preventative security technologies in place, only 27% had a formal cyber incident response plan.
• The TalkTalk data breach in 2015 cost £77M.
• A major incident response may be needed when there is major regulatory non-compliance or potential harm to employees, customers, or the public.
• Detection sources can include help desks, SIEM, press contact, law enforcement agencies, and social media.
• A sample severity scale categorizes incidents as Red, Amber, and Yellow based on threat level.
• Under EU GDPR, a regulator must be informed within 72 hours of becoming aware of a personal data breach.
• Data subjects must be informed without delay when required by law.
• Major incident response invocation may require rapid evidence review by a nominated senior manager and must operate 24x7.
• The UK police and emergency services use a “Gold-Silver-Bronze” command structure.

• “While 90% of businesses had preventative security technologies like firewalls, anti-malware and security patching tools in place, only 27% had a formal cyber incident response plan.”
• “While it is important to spend on prevention, it is also vital to prepare for an incident.”
• “When a cyber incident or data breach occurs, you need a plan for what to do.”
• “The challenge is to rapidly identify those that may indicate a potential major incident.”
• “It is sometimes thought that dealing with a cyber incident involves only highly specialized technicians.”
• “Normal organizational structures are poor at responding to emergency situations.”
• “The immediate priority is to prevent the effects of the incident from spreading.”
• “However, it is important to ensure that any forensic evidence is preserved before wiping systems and re-installing software.”
• “However, it is essential to validate that the systems are clean and operating correctly… otherwise the incident could quickly recur.”
• “Don’t forget to test the plan at regular intervals and practice, practice, practice.”