What should the CEO do in the first hour of a cyber incident?
Take a few decisions quickly and leave the technical work to the people doing it. Confirm who leads the response and who speaks for the company. Call your insurer's incident line early, because many policies require prompt notice and name the response firm they will pay for. Bring in legal advice, and the data protection officer if personal data may be involved. Start the clocks: under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. the early warning is due within 24 hours of becoming aware of a significant incident, and under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). a breach is notified to the authority within 72 hours where feasible. Do not let anyone wipe systems before evidence is secured, and do not pay or contact the attackers without advice. NetSenX tracks the NIS2 deadlines per incident and keeps the alerts showing what crossed the network.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).