How do we prepare for a cyber incident before it happens?
By deciding now what you would otherwise improvise in the middle of the night. Write a one-page plan: who leads, who may shut systems down, who talks to customers, insurers and regulators. Keep phone numbers on paper and in a second channel, because e-mail and chat may be down or compromised. Know your three or four most important systems and the order in which you would restore them, and test a restore from backup. Agree terms with an incident-response provider before you need one, and check whom your cyber insurance requires you to call first. Make sure the logs you would need exist and are kept long enough: firewall, VPN, directory and network history. NetSenX contributes the network history and explained alerts, and PDF reports from the Starter plan make an evidence pack easier to hand over.