# What should the CEO do in the first hour of a cyber incident?

Take a few decisions quickly and leave the technical work to the people doing it. Confirm who leads the response and who speaks for the company. Call your insurer's incident line early, because many policies require prompt notice and name the response firm they will pay for. Bring in legal advice, and the data protection officer if personal data may be involved. Start the clocks: under NIS2 the early warning is due within 24 hours of becoming aware of a significant incident, and under the GDPR a breach is notified to the authority within 72 hours where feasible. Do not let anyone wipe systems before evidence is secured, and do not pay or contact the attackers without advice. NetSenX tracks the NIS2 deadlines per incident and keeps the alerts showing what crossed the network.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [For the board and finance](https://netsenx.com/en/faq/board) · https://netsenx.com/en/faq/what-should-the-ceo-do-in-the-first-hour-of-a-cyber-incident

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/blog/2026-10-09_cybersecurity-for-the-board
- https://netsenx.com/en/pricing

## Related questions

- [Who in the company should decide on a ransom demand?](https://netsenx.com/en/faq/who-should-decide-on-a-ransom-demand)
- [Which payment controls stop invoice fraud and fake CEO requests?](https://netsenx.com/en/faq/which-payment-controls-stop-invoice-and-ceo-fraud)
- [Should cyber risk be in the company risk register?](https://netsenx.com/en/faq/should-cyber-risk-be-in-the-company-risk-register)
- [How should the board approve a cyber security budget?](https://netsenx.com/en/faq/how-should-the-board-approve-a-cyber-security-budget)
- [What is the difference between a security alert and an incident?](https://netsenx.com/en/faq/what-is-the-difference-between-a-security-alert-and-an-incident)