Strategy
Cyber strategy & ransomware posture
A board-level decision on ransomware payment, crisis communication tone, and the maximum tolerable downtime for each business-critical service.
CIR · Incident Response · Crisis Management
Cyber Incident Readiness
Readiness Assessment
A focused readiness check for organisations preparing for the inevitability of a cyber incident. Assesses strategy, planning, operational reaction capability, and communication — the four dimensions that determine whether an incident is contained or becomes a crisis.
- 25 QuestionsAssessment
- ~12 minDuration
- All OrganisationsScope
Who it applies to
- Any organisation that depends on IT to operate — incident readiness is independent of regulation
- Boards and executive teams that need a defensible answer to 'what happens if we get hit?'
- Insurers, customers, and investors evaluating cyber resilience as part of due diligence
Key articles & clauses, in plain English
The five points auditors and supervisors actually verify first.
Plan
Incident response plan & rehearsal
A documented IR plan with named roles, escalation paths, and at least one tabletop or simulation exercise per year — tested with the actual people who would respond.
Detect
Detection, containment & recovery
Logging and monitoring sufficient to establish a timeline; pre-agreed containment playbooks; a tested recovery procedure for the top 3 business-critical services.
Communicate
Regulatory notification & communications
Pre-drafted notification templates, an up-to-date contact list for regulators, customers, and partners, and a designated spokesperson for media.
Forensics
Forensic readiness & external partners
A retainer with a forensic / DFIR provider, a legal counsel briefed on cyber incident handling, and a cyber insurance broker on speed-dial.
What this assessment covers
4 topics · 25 self-assessment questions.
- Domain 01
Strategy
A documented cyber incident strategy defines how the organisation prepares for, decides on, and learns from cyber incidents. Without an explicit strategy — covering ransomware payment posture, transparency commitments, and executive accountability — operational response is improvised under pressure.
- Domain 02
Planning
Planning operationalises strategy. It establishes a written incident response plan, named roles, contact lists, asset inventories, and rehearsal cadence — so that when an incident occurs, the response is structured rather than reactive.
- Domain 03
Reaction
Reaction covers the operational capability to detect, contain, eradicate, and recover from a cyber incident. This includes monitoring, logging, forensic readiness, recovery procedures, and the technical decision-making capacity required during the first 24–72 hours.
- Domain 04
Communication
Communication during and after an incident shapes regulatory exposure, reputational damage, and stakeholder trust. This domain covers internal coordination, customer notification, regulatory reporting timelines, media handling, and transparent post-incident reporting.
Top audit pitfalls
- An IR plan that has never been read by the people who would actually use it during an incident.
- No prior decision on ransomware payment — leaving it to the night of the incident, under maximum pressure.
- Logs that are insufficient to reconstruct a 30-day timeline, blocking forensic investigation and regulatory notification.
Frequently asked questions
Tabletop exercises at least annually; full simulations every 18–24 months. After every real incident or near-miss, a hot wash and plan update within 30 days.
No. Insurers increasingly require evidence of readiness (MFA, EDR, backups, IR plan, exercises) as a precondition for a policy. Without readiness, premiums rise sharply or coverage is denied.
Yes. The decision to pay or refuse is fundamentally a business and ethical decision, not a technical one. It belongs in a board-approved policy, not an incident-night phone call.
Logging insufficient to establish a timeline. Without 90 days of meaningful logs from endpoints, identity providers, and network gateways, forensic investigation is severely constrained.
A named incident response leader — typically the CISO or CIO — supported by a cross-functional team covering IT, legal, communications, and senior leadership. Single-person ownership fails under load.
NIS2 mandates 24-hour early warning and 72-hour incident notification. Without practised incident readiness, those timelines are nearly impossible to meet — readiness is the operational foundation of NIS2 compliance.
Start your Cyber Incident Readiness assessment
25 questions · ~~12 min · Scorecard based on your answers. No sign-up to begin.