Incident Response: Top 10 Actions
What Boards Must Do DURING an Active Cyber Crisis
CyberCQR Top 10 | January 2026 | 5 minutes reading time
The Critical 72 Hours
When a cyber incident occurs, the first 72 hours determine whether your organisation survives intact or faces catastrophic damage. These 10 actions guide boards through the critical decisions that minimise harm and demonstrate proper governance.
1. Convene Emergency Board Meeting Within 24 Hours
What to do:
- Full board or appropriate committee meets within 24 hours of material incident
- Receive briefing from CEO, CISO, legal counsel, and external incident response team
- Document attendance and discussion (under attorney-client privilege)
- Establish ongoing briefing cadence (daily in early stages, then as needed)
âš Critical: Rapid board engagement demonstrates proper governance and allows board to fulfil oversight duty.
2. Activate Pre-Approved External Resources Immediately
What to do:
- Immediately engage cyber incident response firm (no delay, no assessment period)
- Activate specialised legal counsel (cyber/privacy expertise)
- Notify cyber insurance carrier within required timeframe
- Engage forensics team for evidence collection and preservation
- Activate crisis communications firm if incident will be public-facing
⚠Critical: Don't wait to "assess" before calling experts—every hour of delay increases damage exponentially.
3. Establish Attorney-Client Privilege Over Incident Response
What to do:
- Engage legal counsel to direct incident response (establishes privilege)
- External experts (forensics, incident response) work at direction of counsel
- Mark all incident-related communications as attorney-client privileged
- Separate public communications from privileged investigation work product
âš Critical: Privilege protection is essential for candid assessment and can protect findings from discovery in shareholder lawsuits.
4. Assess Scope, Impact, and Root Cause
What to do:
- Understand: What systems affected? What data accessed? How did attackers get in?
- Assess business impact: Operations disrupted? Revenue at risk? Customer impact?
- Determine if threat is contained or ongoing (attackers still in environment?)
- Identify any regulatory reporting obligations triggered by incident
âš Critical: Board needs facts, not speculation. Push for evidence-based assessment, but accept that complete picture takes time.
5. Make Rapid But Informed Decisions
What to do:
- Approve containment actions (e.g., system shutdowns, network segmentation)
- Decide on ransom payment if demanded (consider legal, ethical, practical factors)
- Authorise additional resources/budget for response (pre-approve spending authority)
- Approve communication strategy and public statements
âš Critical: Document all board decisions and rationale. Show deliberate, reasoned judgement even under extreme pressure.
6. Coordinate Regulatory Notifications
What to do:
- Review legal obligations: GDPR (72 hours), SEC (4 days), sector-specific timelines
- Approve notification content and timing (balance accuracy with incomplete information)
- Ensure notifications are accurate but don't over-disclose before facts known
- Coordinate with legal counsel to protect privilege while meeting obligations
⚠Critical: Missing regulatory deadlines can result in penalties exceeding the incident cost itself. GDPR: €20M or 4% of global revenue.
7. Manage Stakeholder Communications
What to do:
- Approve customer communications—what to disclose, when, and how
- Manage employee communications—maintain morale, prevent panic and rumors
- Coordinate with partners/vendors who may be affected or at risk
- Prepare for media inquiries—designate spokesperson, approve all messaging
- Brief investors/shareholders if incident has material financial impact
âš Critical: Inconsistent messaging creates confusion and damages trust permanently. One voice, coordinated approach.
8. Monitor Management Performance and Provide Support
What to do:
- Assess whether management is responding effectively and decisively
- Provide support and remove barriers (budget, authority, resources)
- Be prepared to replace leadership if response is demonstrably inadequate
- Balance accountability with support—don't micromanage but don't abdicate oversight
âš Critical: Board's role is oversight and strategic support, not operational management. Trust experts but verify progress.
9. Plan for Business Continuity and Recovery
What to do:
- Understand recovery timeline: Days? Weeks? Months?
- Assess financial impact and cash flow implications (immediate and ongoing)
- Approve workarounds to maintain critical operations during recovery
- Consider long-term impacts: customer loss, competitive damage, reputation harm
âš Critical: Incident response AND business continuity must happen in parallel. Don't focus only on technical recovery.
10. Document Everything for Legal and Governance Record
What to do:
- Maintain detailed board meeting minutes with decisions and rationale
- Document who was informed, when, and what actions were taken
- Preserve attorney-client privilege over sensitive communications
- Create chronological timeline of events and board response
âš Critical: Documentation demonstrates proper governance and may be critical in defending against shareholder lawsuits or regulatory investigations.
Critical Decision Timeline: First 72 Hours
| Timeframe | Critical Actions | Board Decision Required |
|---|---|---|
| 0-4 Hours | Incident detected, containment begins | Notify board chair |
| 4-24 Hours | Activate external experts, initial assessment | Emergency board meeting, approve resource activation |
| 24-48 Hours | Scope determination, containment verification | Approve communication strategy, ransom decision if demanded |
| 48-72 Hours | Regulatory notifications, stakeholder comms | Approve notifications, public statements, recovery approach |
| 72+ Hours | Recovery operations, ongoing monitoring | Monitor progress, authorise resources, manage stakeholders |
The first 72 hours determine the outcome.
Boards that follow these 10 actions minimise financial impact, protect reputation, demonstrate proper governance, and meet fiduciary duties under extreme pressure.
About CyberCQR
CyberCQR provides strategic cybersecurity advisory services to boards and C-suite executives. We help boards prepare for cyber incidents through tabletop exercises that simulate these critical 72 hours and test decision-making under pressure.
Our Services Schedule Tabletop ExerciseDocument ID: BOARD-TOP10-002 | Version: 1.0 | Date: 05 January 2026 | Series: Top 10 for Boards