Cyberattack? Does your company have a security incident response plan?

If your company doesn’t yet have a written security incident response plan, now is the time to create one. In a cyberattack, every minute counts, and a team that knows in advance what to do limits the damage far better than one that improvises. What’s more, for companies covered by NIS2, incident reporting comes with strict deadlines.

What is a cyberattack, and what do you do in the event of a security incident?

Not even the best-secured systems are immune to cyberattacks, let alone those that aren’t secured at all. A cyberattack is someone’s attempt to break into your network, steal your data or bring your business to a halt, and the responsibility for stopping it is yours.

In the face of such a threat, every second counts. Any delay can expose your sensitive data, and that could be extremely damaging. How you respond to a cyberattack makes all the difference. An incident response plan lets you react quickly to intruders.

What is a security incident response plan?

An incident response plan is a tactical approach to managing a security incident. It consists of procedures and policies for preparing for, assessing, containing and recovering from a security incident.

The downtime your organization suffers because of a security incident can drag on, depending on the incident’s impact. An incident response plan makes sure your organization recovers as quickly as possible.

Besides restoring your network to the state it was in before the cyberattack, such a plan helps you keep the incident from happening again.

What does a security incident response plan look like?

An incident response plan is most successful when the documented instructions are followed all the way through. For that to happen, your team must understand the plan and have the skills needed to carry it out.

There are two major incident response frameworks used to manage cyber threats: the NIST and SANS frameworks.

The National Institute of Standards and Technology (NIST), a US government agency, specializes in various areas of technology, and cybersecurity is one of its core services. The image below shows version 1.1 of the NIST Cybersecurity Framework, with its five functions: identify, protect, detect, respond and recover. Version 2.0, published in February 2024, added a sixth function: govern.

For a long time, the NIST incident response guide described four stages:

• preparation;
• detection and analysis;
• containment, eradication and recovery;
• post-incident activity.

In April 2025, NIST published a new revision of the guide, SP 800-61 Rev. 3, which organizes its recommendations around the six functions of the 2.0 framework. The basic idea remains the same: incident response is part of managing security risks, not a document you write once and forget.

SANS (SysAdmin, Audit, Network and Security), a private organization, is known for its cybersecurity expertise and its training courses. The SANS incident response framework is widely used and has six stages:

• preparation;
• identification;
• containment;
• eradication;
• recovery;
• lessons learned.

Although the number of stages differs, the NIST and SANS frameworks are similar. For a more detailed look, let’s focus on the SANS framework.

Backup as a Service: tell me more →

1. Preparation

A good incident response plan starts with preparation, and both frameworks, NIST and SANS, recognize this. At this stage, you review the security measures you currently have in place and how effective they are.

The review process involves a risk assessment of your network to uncover any vulnerabilities. You need to identify your IT assets and prioritize them accordingly, giving the highest importance to the systems that hold the most sensitive data.

Building a strong team and assigning a role to each member is also part of the preparation stage. Give everyone the information and resources they need to respond promptly to a security incident.

2. Identifying the cyberattack

Once you’ve prepared the environment and the right team, it’s time to detect any threats that might exist in your network. You can do this with threat intelligence feeds, firewalls, endpoint detection and response (EDR) solutions, SIEM and IPS, which monitor and analyze data to find indicators of a cyberattack.

If a cyberattack is detected, you and your team must determine the nature of the attack, its source, its capabilities and any other information needed to prevent a breach.

3. Containing the cyberattack

In the containment phase, the goal is to isolate the cyberattack and render it harmless before it damages your system.

Containing a security incident effectively requires an understanding of the incident and of the damage it can do to your system.

Back up your files before you start the containment process, so you don’t lose sensitive data along the way. It’s important to preserve forensic evidence for later investigations and for any legal issues.

4. Eradication

The eradication phase involves removing the threat from your system. Your goal is to bring the system back to the state it was in before the incident occurred. If that’s impossible, try to get as close as you can to its previous state.

Restoring the system may require several actions, including wiping hard drives, updating software versions, eliminating the root cause and scanning the system to remove any malicious content that might remain.

5. Recovery

You want to make sure the eradication stage was successful, so you need to run several analyses to confirm that your system is completely free of any threat.

Once you’re sure there are no more problems, you need to test the system to get it ready to go back into operation. Keep a close eye on your network after the restart too, to make sure nothing is wrong.

6. Lessons learned

Preventing a security breach from happening again means noting what went wrong and fixing it. Every stage of the incident response plan should be documented, because the documentation holds vital information about the lessons that can be learned.

Once you’ve gathered all the information, you and your team should ask yourselves a few key questions, including:

• What exactly happened?
• When did it happen?
• How did we handle the incident?
• What measures did we take in response?
• What did we learn from this incident?

IT services for companies: tell me more →

What reporting obligations does a company have after an incident?

Companies covered by NIS2 must report significant incidents to DNSC (Romania’s National Cyber Security Directorate) within strict deadlines. Directive (EU) 2022/2555, transposed into Romanian law by GEO 155/2024, requires an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours and a final report within one month at most. In Romania, the early warning is sent through PNRISC, the national reporting platform, or by calling 1911.

If the incident affects personal data, the GDPR requires notifying ANSPDCP (the Romanian data protection authority) within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the people concerned. If the risk is high, the people whose data was affected must also be informed.

Your response plan must state clearly who makes these notifications, with what information and by when, so you don’t have to work it out in the middle of an incident.

Best practices for an incident response plan in the event of a cyberattack

Adopting the NIST or SANS security incident response plan is a solid way to approach a cyberattack. But for excellent results, there are a few practices you need to follow.

Identify your critical assets

Cyberattackers go after your most valuable assets. You need to identify your critical assets and prioritize them in your plan.

When faced with a security incident, the first thing to do is secure your most valuable assets, to prevent attackers from accessing or damaging your data.

Set up effective communication channels

The flow of communication in your plan can make or break your response strategy. Make sure everyone involved has the right information at every moment, so they can take the appropriate action.

Waiting for a security incident to happen before preparing your communication flow is risky. Preparing it in advance will give your team confidence. Also keep the contact list on paper or somewhere separate: during an attack, the company’s email and servers may be unavailable.

Keep it simple

A security incident is exhausting. Your team members will probably be worn out from trying to save the situation. Don’t make their job harder with complex details in your incident response plan.

Be specific

Although you want the information in your plan to be easy to understand and carry out, don’t water it down with excessive generalizations. Create specific procedures for what team members need to do.

Create incident response playbooks

A customized plan is more effective than a generic one. For better results, create a playbook for each type of security incident: ransomware, a compromised email account, a lost laptop, a data leak.

For ransomware, you can start from the first steps after a ransomware attack, based on the CISA response checklist and DNSC recommendations.

A good procedure gives your response team a step-by-step guide to handling a specific cyber threat thoroughly, instead of trying to improvise on the spot.

Keep isolated backups

Ransomware also encrypts the backups it can reach. Keep at least one offline or immutable copy and test restores regularly, so you know how long it takes to get back up and running. You’ll find more in the article on the 3-2-1 backup policy.

Test the plan

The most effective incident response plan is one that is tested continuously and has proven that it works.

Don’t create a plan and forget about it. Run security exercises regularly, such as tabletop simulations of an attack, to identify the gaps that cyberattackers could exploit.

Take a proactive approach to security

Cyberattackers catch people and organizations off guard. Nobody wakes up in the morning expecting their network to be hacked. Although you don’t want a security incident, there’s a chance it could happen.

The least you can do is be proactive and create an incident response plan, in case a cyberattack targets your network.

RezolvIT is an ISO/IEC 27001-certified IT outsourcing company that supports the companies it works with in IT security and NIS2 compliance. In an incident, our clients get a phone response within 15 minutes and remote intervention within one hour. If you want to find out how prepared your company is for a cyberattack, request a free IT audit.