# What does management have to decide in the first day of a cyber incident?

Usually five things. Whether to isolate systems or the whole site, accepting the interruption that brings. Whom to bring in: an incident-response firm, the insurer's hotline, a lawyer. Whether the incident may be reportable, to the national CSIRT under NIS2 or to the data protection authority under the GDPR, and who prepares the notification. What to tell staff, customers and partners, and when, without promising what is not yet known. And how to keep the business running: manual processes, alternative communication, which customers to call first. None of these is technical, which is why a technical team cannot make them alone. Prepare them as options in your plan. NetSenX gives management a factual starting point: which hosts showed which behaviour and when, and the NIS2 Article 23 deadlines tracked for the incident.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-management-decides-in-the-first-day-of-an-incident

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we communicate during an incident if our e-mail may be compromised?](https://netsenx.com/en/faq/how-to-communicate-when-email-may-be-compromised)
- [Why should we keep a written log during an incident?](https://netsenx.com/en/faq/why-keep-a-written-log-during-an-incident)
- [How do we contain an incident without destroying the evidence?](https://netsenx.com/en/faq/how-to-contain-an-incident-without-destroying-evidence)
- [Should we unplug an infected computer or switch it off?](https://netsenx.com/en/faq/should-we-unplug-or-switch-off-an-infected-computer)
- [What should we avoid doing during a cyber incident?](https://netsenx.com/en/faq/what-not-to-do-during-a-cyber-incident)