How do we decide how serious an incident is?
By its effect on the business, not by how alarming it looks. A simple scale works: low when one device is affected and contained, medium when an account or several devices are involved, high when important systems or personal data are at risk, and critical when operations stop or data has left the company. Ask what is affected, how many systems and people, whether personal or customer data is involved, whether it is spreading, and whether services you provide to others are disrupted. The answer decides who is called, how fast, and whether reporting obligations may apply: NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. works with the notion of a significant incident and the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). with a personal data breach, each with its own tests. Agree the scale in advance and write it into your plan. NetSenX shows on each alert what was seen and on which hosts, a starting point for this judgement rather than a replacement for it.
Read next
Related questions
- Who makes the decisions during a cyber incident?
- What does management have to decide in the first day of a cyber incident?
- How do we communicate during an incident if our e-mail may be compromised?
- Why should we keep a written log during an incident?
- How do we contain an incident without destroying the evidence?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).