Would your board know what to do in the first hour?
Most organisations have an incident plan. Far fewer have rehearsed the leadership decisions that sit on top of it.
When a serious cyber incident begins, the technical response usually starts quickly. What slows organisations down is rarely the technology. It is the moment a decision needs an owner and nobody is certain who that is.
The first hour sets the tone for everything that follows. Three questions are worth answering now, calmly, rather than for the first time under pressure.
1. Who can authorise containment that interrupts the business?
Isolating systems, suspending a service or taking a site offline may be the right technical move — and it may also stop revenue, production or customer service. Your security team needs to know who can say yes, and that person needs enough context to decide quickly.
If the answer depends on who happens to be available, write down a primary and a deputy, and agree the threshold at which they must be called.
2. How will leaders communicate if normal channels are unavailable?
Email, chat and shared drives may be affected or untrustworthy during an incident. Leadership teams that have never discussed an alternative tend to improvise, often on personal devices and in fragmented groups.
Agree in advance how the core team will reach each other, where the up-to-date contact list lives offline, and who speaks for the organisation internally and externally.
3. Who assesses reporting obligations and when external advice is needed?
Depending on your sector and the data involved, an incident may trigger obligations towards regulators, customers or partners. Someone needs to own the question early, even before the facts are complete.
Know which legal, insurance and specialist advisers you would call, and who in your organisation is authorised to engage them.
A practical next step
Run a short leadership tabletop exercise — sixty to ninety minutes is enough. Walk through a plausible scenario, pause at each decision point, and ask who owns it.
- Record every moment where ownership was unclear or contested.
- Assign each gap to a named person with a date to resolve it.
- Revisit the scenario once the gaps are closed, ideally with deputies in the room.