# How do we prepare for a cyber incident before it happens?

By deciding now what you would otherwise improvise in the middle of the night. Write a one-page plan: who leads, who may shut systems down, who talks to customers, insurers and regulators. Keep phone numbers on paper and in a second channel, because e-mail and chat may be down or compromised. Know your three or four most important systems and the order in which you would restore them, and test a restore from backup. Agree terms with an incident-response provider before you need one, and check whom your cyber insurance requires you to call first. Make sure the logs you would need exist and are kept long enough: firewall, VPN, directory and network history. NetSenX contributes the network history and explained alerts, and PDF reports from the Starter plan make an evidence pack easier to hand over.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-to-prepare-for-a-cyber-incident

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What should an incident response plan contain?](https://netsenx.com/en/faq/what-should-an-incident-response-plan-contain)
- [Who should be on the incident team in a small company?](https://netsenx.com/en/faq/who-belongs-on-a-small-company-incident-team)
- [What is an incident response retainer, and do we need one?](https://netsenx.com/en/faq/what-is-an-incident-response-retainer)
- [What is a tabletop exercise, and how do we run one?](https://netsenx.com/en/faq/what-is-a-tabletop-exercise)
- [What is the difference between an event, an alert and an incident?](https://netsenx.com/en/faq/difference-between-an-event-an-alert-and-an-incident)