No company can completely rule out security incidents. What matters is how quickly and how orderly it responds when an incident occurs. Without preparation, typical mistakes happen in an emergency: systems are rebuilt prematurely and evidence is destroyed, nobody knows who is allowed to decide, or reporting deadlines are missed. Incident response ensures that these questions are settled in advance.
How does incident response work?
Established frameworks, for example from the US institute NIST, describe the process in phases. In simplified form, these steps can be distinguished:
- Preparation: Emergency plan, responsibilities, contact lists, tools, and exercises.
- Detection and analysis: An alert or a report is assessed. Is it a real incident, how serious is it, and which systems are affected?
- Containment: The spread is stopped, for example by isolating devices or locking accounts.
- Eradication: Malware, backdoors, and compromised access are removed.
- Recovery: Systems are restored from clean backups and brought back into operation in a controlled manner.
- Post-incident activity: Causes and processes are evaluated, measures are derived, and the plan is improved.
Communication and documentation run in parallel: management, employees, and, where applicable, customers, insurers, and authorities must be informed at the right time. In the event of a personal data breach, the GDPR generally requires notification to the competent data protection supervisory authority within 72 hours. Entities within the scope of NIS2 are also subject to their own reporting obligations.
Typical examples
- An employee reports that she entered her password on a fake sign-in page. The account is locked, and sign-ins and mailbox rules are checked.
- A ransomware attack encrypts servers. The emergency team disconnects affected network segments, secures evidence, and plans the recovery.
- A vulnerability in a web portal was exploited. It is checked whether data was exfiltrated.
What companies should keep in mind
- Create a short, written emergency plan that is also available in print in case IT systems fail.
- Define responsibilities and decision-making authority, including deputies for vacation and sick leave.
- Arrange external support such as IT forensics or legal advice in advance, not only in an emergency.
- Practice the plan regularly, for example in tabletop exercises.
- Align incident response with backup and recovery and business continuity management.
This entry is a general overview and does not replace legal advice.
View security services