When a breach is detected, the first instinct is to call the IT or security team. That instinct is right and incomplete. Containment and forensics are technical work, but nearly every consequential decision in the first 72 hours is not: whether to notify a regulator, what to tell customers, whether to take a revenue-generating system offline, whether to engage law enforcement, what the insurer needs to hear and when.
Organizations that handle breaches well are rarely the ones with the best tooling. They are the ones that settled, before the incident, who decides what, who must be told, and in what order. Everyone else works this out live, at 2 a.m., while the clock is running.
Who needs to be in the loop
A useful test: if a breach would surprise someone on this list, your response plan has a hole in it.
- Executive leadership and the board. They own the risk-acceptance decisions: ransom, downtime, public disclosure. They need a named briefing channel and a decision-ready summary, not a raw technical feed.
- Legal counsel and the data protection officer. They determine notification duties and preserve privilege. Under GDPR the clock to notify the supervisory authority is 72 hours from awareness; under NIS2 an early warning is due within 24 hours for in-scope entities. Both clocks start before the investigation is finished.
- Communications. Holding statements, customer messaging, staff messaging, and media handling. If these are written under pressure, they tend to over-promise or contradict the legal position.
- HR. Insider involvement, compromised employee data, and the staff who will be asked questions by customers and journalists.
- Finance and the cyber insurer. Most policies require prompt notice and pre-approved response vendors. A late call can jeopardize cover.
- Business and operations owners. They know what an outage actually costs per hour and what can run manually. Without them, the technical team has no basis for the isolate-or-keep-running trade-off.
- Procurement and third-party owners. A large share of incidents involve a supplier, either as the entry point or as the holder of the affected data. Someone must own those contracts and contacts.
- External parties: incident response retainer, forensics, outside counsel, regulators, law enforcement, and key customers or partners with contractual notice duties.
The decisions that are not technical
A breach forces a short list of hard calls. None of them can be settled by the security team alone, and none benefit from being debated for the first time mid-incident.
- Do we take a business-critical system offline, and who is authorized to accept that cost?
- Is this a notifiable event, to whom, and by when?
- What do we say publicly, and who is the single voice for it?
- Do we engage law enforcement, and what does that do to our timeline and control?
- If extortion is involved, who has the authority to even discuss payment, and what are the legal constraints?
Writing down the owner and the escalation path for each of these costs an afternoon. Not having done it costs days during a live incident.
Why a plan on paper is not enough
An incident response plan that has never been exercised is a hypothesis. The usual failures are mundane: the contact list is out of date, nobody knows who can approve a shutdown, the legal team has never seen the plan, or the plan assumes the email system is still available when it is the thing that has been compromised.
These problems do not show up in a document review. They show up the first time people have to use the plan together, which is why rehearsal matters more than another revision.
Tabletop exercises: the cheapest rehearsal you can run
A tabletop exercise is a facilitated, discussion-based walkthrough of a realistic scenario. No systems are touched. A facilitator introduces events (injects) in sequence and the group talks through what they would do, who they would call, and what they would decide. Two to three hours is enough for a first session.
What makes one worthwhile:
- Bring the non-technical people. A tabletop attended only by IT is a technical review. The value is in legal, communications, HR, finance, and an executive sponsor working through the same timeline.
- Use a scenario that fits your business: ransomware on a core system, a supplier compromise exposing customer data, a phished executive mailbox, or data posted publicly by an extortionist.
- Escalate with injects. Introduce a regulator inquiry, a journalist call, a second system affected, or a key person unreachable. The pressure points are where the gaps are.
- Make it blameless. The aim is to find friction in the process, not to test individuals.
- Capture actions, not impressions. Every exercise should end with a short list of named owners and dates: update the contact tree, pre-approve a holding statement, agree who can authorize shutdown.
Drills: practise the parts that are muscle memory
Tabletops test decisions. Drills test execution. They are narrower, more frequent, and often more revealing.
- Call-tree and out-of-band communication drills: can you reach the response team and executives when email and chat are down?
- Backup restoration tests: not whether backups exist, but whether a critical system can actually be restored within the time the business expects.
- Technical response drills: isolating a host, revoking credentials at scale, rotating keys, and preserving evidence correctly.
- Notification drills: draft the regulator notification and the customer message from the template and time how long it takes.
A practical starting point
- This month: name an incident owner, a deputy, and an executive decision-maker. Write down the contact details somewhere that does not depend on your own network.
- This quarter: run a two-hour tabletop with legal, communications, HR, finance, operations, and IT in the room. Fix the top five gaps it exposes.
- Twice a year: repeat with a different scenario, and add at least one technical drill, starting with a backup restore.
- After every real incident or near miss: hold a blameless review and feed the findings back into the plan.
The goal is not a flawless response. It is a response where the people involved have met before, know their role, and already know where the decisions sit. That is what turns a breach from a crisis into an incident.
If you would like help designing or facilitating a tabletop exercise for your organization, get in touch through the consultation form.