Prepare Before the Pressure

One of the hardest things for any business is stepping away from day-to-day operations long enough to ask:

What would we actually do if we had a serious cyber incident tomorrow?

Over the years, I’ve seen that the biggest problems during an incident are often not purely technical. They come from uncertainty: unclear responsibilities, delayed decisions, assumptions about who is doing what, and plans that have never really been tested.

So the questions worth asking are broader:

• Who would make the key decisions?

• Who would decide whether systems should go or stay offline?

• Who would speak to customers, staff, suppliers and regulators?

• Who would contact the insurer, legal advisers or external incident responders?

• Which services would we restore first?

• And could the business continue operating while all of this was happening?

Cyber incidents create pressure, uncertainty and incomplete information. That is the worst possible time to discover that responsibilities are unclear or that important decisions have never been discussed.

Even a short pause from day-to-day delivery can be incredibly valuable.

Bring the right people together. Walk through a realistic scenario. Test the assumptions. Find the gaps. You do not need to predict every possible incident. You do need to make sure that, when something happens, the organisation knows how to respond.

Build cyber resilience before the incident.