As an Incident Response provider, CERTAINITY regularly supports organizations affected by ransomware and other cyber attacks that can have devastating consequences for business operations. In this article, we outline the most important do’s and don’ts when responding to a cyber incident.
Incident response encompasses all technical, organizational, and communication measures required to contain a cyber attack, minimize its impact, and restore normal business operations as quickly as possible. An effective response can significantly reduce financial losses, operational disruption, and reputational damage.
Here are some essential best practices for handling cyber incidents effectively:
DO
Establish an Incident Response Plan
A clearly defined Incident Response Plan is essential for responding effectively to cyber incidents. It should define roles and responsibilities, communication procedures, escalation paths, and the steps required to contain and remediate an attack.
Build a Dedicated Incident Response Team
Assemble a multidisciplinary team with the expertise required to manage cyber incidents. In addition to IT and cyber security specialists, the team should include representatives from legal, human resources, communications, and executive management.
Identify and Contain the Incident
The first priority is understanding what happened and assessing the scope of the incident. This includes identifying the attack vector, affected systems, and exploited vulnerabilities.
Once the situation has been assessed, immediate containment measures should be taken—for example isolating compromised systems, disabling affected accounts, or activating additional security controls to prevent further damage.
Communicate Effectively
Clear communication is critical throughout every stage of an incident. Relevant stakeholders inside and outside the organization—including employees, customers, business partners, regulators, law enforcement, or cyber insurers—should receive timely, accurate, and coordinated information.
Conduct a Lessons Learned Review
After the incident has been resolved, perform a structured post-incident review to identify lessons learned and improve your Incident Response Plan, security controls, and organizational processes. Continuous improvement strengthens your resilience against future attacks.
DON’T
Don’t Panic
Stay calm and make decisions based on facts rather than emotions. Panic often leads to poor decisions that can worsen the situation.
Don’t Delay Your Response
Time is one of the most critical factors during a cyber incident. The longer attackers remain undetected, the greater the potential damage. Act quickly to contain the incident and limit its impact.
Don’t Ignore Legal and Regulatory Requirements
Be aware of all applicable legal and regulatory obligations. Depending on the incident, reporting requirements may exist under regulations such as GDPR, NIS2, or sector-specific legislation, and notifications to authorities, customers, or partners may be required.
Don’t Forget the Human Factor
Cyber security is about more than technology. Employees are often directly affected by cyber incidents and may require guidance, reassurance, or additional support. Clear communication helps reduce uncertainty and enables staff to contribute effectively during recovery.
Don’t Pay the Ransom Without Expert Advice
Paying a ransom supports the attackers’ business model and offers no guarantee that systems or data will be recovered. If your organization finds itself in a situation where payment is being considered, never negotiate directly with the attackers. Instead, seek assistance from experienced Incident Response professionals and specialist negotiators.
Conclusion
An effective cyber incident response requires a well-prepared Incident Response Plan, an experienced response team, rapid decision-making, and structured communication. Organizations must also consider legal obligations and the human impact of an attack while continuously improving their response capabilities through lessons learned.
By following these best practices, organizations can significantly reduce the impact of cyber incidents and restore business operations more quickly.
Most importantly, if you experience a cyber incident, seek professional Incident Response support as early as possible.
Stay safe.