# Who makes the decisions during a cyber incident?

One named person, with a named deputy and the authority to act without a meeting. Decisions in an incident are urgent and uncomfortable: cutting the company off from the internet, stopping a production system, calling the police, telling customers. If nobody is clearly allowed to take them, hours are lost waiting for agreement. In most small companies the decision-maker is the managing director, advised by IT and an external responder; in larger ones an incident manager acts for the board within agreed limits. Write down which decisions this person may take alone and which need the board, and make sure the deputy can be reached when the leader is travelling. NIS2 also makes the management bodies of covered entities responsible for approving and overseeing cybersecurity risk-management measures, so the board should know the plan before it is needed.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/who-makes-decisions-during-a-cyber-incident

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What does management have to decide in the first day of a cyber incident?](https://netsenx.com/en/faq/what-management-decides-in-the-first-day-of-an-incident)
- [How do we communicate during an incident if our e-mail may be compromised?](https://netsenx.com/en/faq/how-to-communicate-when-email-may-be-compromised)
- [Why should we keep a written log during an incident?](https://netsenx.com/en/faq/why-keep-a-written-log-during-an-incident)
- [How do we contain an incident without destroying the evidence?](https://netsenx.com/en/faq/how-to-contain-an-incident-without-destroying-evidence)
- [Should we unplug an infected computer or switch it off?](https://netsenx.com/en/faq/should-we-unplug-or-switch-off-an-infected-computer)