The Assurance Desk
Part of the guide Incident response plan: what to write down
What should happen in the first hour?
The first hour is about getting the response under way. Give someone clear authority to coordinate it. The National Cyber Security Centre, or NCSC, recommends using an NCSC assured Cyber Incident Response provider to help investigate.
Find out which critical business functions are affected. If normal email or chat cannot be trusted, arrange another way for staff and responders to communicate.
Work that can run alongside the investigation
- Coordinate Direct the response and weigh business and safety impacts. Name who can make decisions.
- Investigate and contain Bring in technical responders to assess the attack. Use specialist help where available.
- Communicate and record Keep a trusted route for updates and a central incident log. Record decisions, reasons and actions.
- Check reporting Check legal duties and insurer requirements. Give the task a named owner.
Should you disconnect computers or shut them down?
Disconnecting and shutting down have different effects. Technical responders should weigh the choice against safety, the damage still happening and the evidence needed to understand the attack.
Disconnecting and powering off
Disconnect from networks
- Can block further attacker commands and limit spread.
- Can preserve evidence for the investigation.
- May not stop harmful activity already running.
Shut systems down
- May halt active processes.
- Can lose evidence needed for the investigation.
- Can make it harder to confirm that the attacker has gone.
Who keeps the response moving?
A clear lead keeps decisions coordinated while the people with the right skills do the work. Use a trusted route for updates and keep a central record of what is agreed.
Lisa Forte puts the chair’s job plainly in her LinkedIn post.
The chair's role isn't to have all the answers. It's to get the best answers from the people around the table.
What should go in the incident log?
The incident log should record what was found, when it was found, who made each decision and why. Keep agreed actions and their status in the same record.
| Record | Question to answer |
|---|---|
| Finding | What has been discovered? |
| Time | When was it discovered? |
| Decision | What was decided, by whom and why? |
| Action | What was agreed and what is its current status? |
Can you recover from backups straight away?
Check the backups before recovery starts. Find out when they were taken, whether they are available and whether the attack has affected them. Where possible, the investigation should come before restoration.
The NCSC says backups should connect only to devices known to be clean. Scan the backups for malicious software before restoring files. Having a backup is a starting point for these checks.
When does a UK ransomware incident need reporting?
Check the reporting duties as the response starts. An NCSC incident report does not meet separate legal reporting requirements. Check your cyber insurer’s requirements too.
For UK personal data, loss of access can matter as well as theft. The ICO says a personal data breach can affect confidentiality, accuracy or availability. Assess the risk to the people whose data is involved.
In the UK, a controller decides why and how personal data is used. A processor handles that data on the controller’s behalf.
UK controllers must report a notifiable breach to the ICO without undue delay. They must report no later than 72 hours after becoming aware of it. A processor must tell its controller without undue delay after becoming aware.
The ICO allows required information to follow in phases without undue further delay. Record all personal data breaches, including those that do not need an ICO report. The separate reporting guide explains the risk test in more detail.
What to do
- Bring together the incident lead, technical responders and specialist help.
- Arrange a trusted way to share updates.
- Assess containment with safety, evidence and business impact in view.
- Start the incident record and check reporting and insurer requirements.
- Check the investigation findings and backup safety before restoration.
Common questions
Does every ransomware attack need an ICO report?
The UK test is whether there has been a personal data breach with a likely risk to people’s rights and freedoms. That assessment includes loss of access, not just stolen files. Record the breach even if it does not need reporting.
Can we wait for the full investigation before reporting?
Do not wait past the UK deadline for a notifiable breach. The ICO requires a report without undue delay and no later than 72 hours after awareness. Missing details can follow in phases without undue further delay.
Should we pay the ransom?
The NCSC says law enforcement does not encourage or endorse ransom payments. Bring the incident to specialist responders and check the relevant legal and insurer requirements.
Will the business be back to normal in an hour?
This guide gives first-response priorities, not a recovery deadline. Investigation findings, affected business functions and the state of backups need to inform recovery decisions.
Where next
Sources
- NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities, checked 8 October 2026
- Lisa Forte on LinkedIn, One of the most common mistakes I see in cyber exercises is a chair who tries to solve the incident themselves. That's not the chair's job. In one exercise we facilitated, the chair became the…, Lisa Forte, 12 comments, checked 8 October 2026
- NCSC, Mitigating malware and ransomware attacks, checked 8 October 2026
- ICO, Personal data breaches: a guide, checked 8 October 2026
- ICO, What are ‘controllers’ and ‘processors’?, checked 8 October 2026
This is an independent editorial guide, not legal advice.