Executive Briefing
When a cyber attack happens, every minute counts. Create an incident response plan that minimises damage, ensures compliance, and speeds recovery.
Why You Need an Incident Response Plan
- Average time to identify a breach: 194 days
- Average time to contain a breach: 69 days
- Prepared organisations reduce breach costs by 61%
- Notifiable Data Breaches scheme requires timely response
Incident Response Phases
1. Preparation
Build response capability before incidents occur: team roles, contact lists, tools, procedures, training.
2. Detection and Analysis
Identify that an incident has occurred, determine scope and severity, classify the incident type.
3. Containment
Stop the incident from spreading: isolate affected systems, block malicious activity, preserve evidence.
4. Eradication
Remove the threat: eliminate malware, close vulnerabilities, reset compromised credentials.
5. Recovery
Restore normal operations: bring systems back online, verify security, monitor for recurrence.
6. Lessons Learned
Review what happened: document timeline, identify improvements, update defences and procedures.
Incident Response Team Roles
- Incident Manager: Overall coordination and decision-making
- Technical Lead: Technical investigation and response
- Communications: Internal and external communication
- Legal/Compliance: Regulatory requirements and legal advice
- Executive Sponsor: Business decisions and resource allocation
How We Researched This Article
This article was compiled using information from authoritative industry sources to ensure accuracy and relevance for Australian businesses.
Sources & References
-
→
ACSC Incident Response Guide
Australian Government guidance on incident response
-
→
NIST Incident Handling Guide
Comprehensive incident response framework
* Information is current as of the publication date. Cybersecurity guidelines and best practices evolve regularly. We recommend verifying current recommendations with the original sources.
Frequently Asked Questions
Do we need to report all security incidents? ▼
Under the Notifiable Data Breaches scheme, you must report breaches likely to cause serious harm. Not all incidents are reportable, but you should assess each one. When in doubt, consult legal advice.
Should we pay ransomware demands? ▼
Generally not recommended. Payment doesn't guarantee recovery, funds criminal activity, and may violate sanctions laws. Focus on recovery from backups. However, each situation is unique—involve legal counsel and law enforcement.