What does management have to decide in the first day of a cyber incident?
Usually five things. Whether to isolate systems or the whole site, accepting the interruption that brings. Whom to bring in: an incident-response firm, the insurer's hotline, a lawyer. Whether the incident may be reportable, to the national CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. or to the data protection authority under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., and who prepares the notification. What to tell staff, customers and partners, and when, without promising what is not yet known. And how to keep the business running: manual processes, alternative communication, which customers to call first. None of these is technical, which is why a technical team cannot make them alone. Prepare them as options in your plan. NetSenX gives management a factual starting point: which hosts showed which behaviour and when, and the NIS2 Article 23 deadlines tracked for the incident.
Read next
Related questions
Terms used here
- CSIRT (computer security incident response team)
- The national team to which serious incidents are reported.
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).