The First Seventy-Two Hours: A Director’s Command Framework for a Serious Cyber Incident

Most cyber incidents do not begin in the boardroom. They begin with an alert, a strange invoice, a helpdesk call or a supplier notification. By the time directors are involved, the organisation may already be losing time. The first 72 hours are not a test of technical brilliance; they are a test of command. Directors need to know who leads, what must be decided, what can wait, and how to avoid choices that make recovery harder.

This playbook is not a substitute for legal advice or specialist incident response support. It is a framework for directors who need to govern a fast-moving event without pretending to be the incident team. The aim is clear-headed control: protect people, preserve evidence, meet obligations, keep the business running and communicate without speculation.

Hour zero to four: declare the incident and establish command

The first decision is whether to declare a serious incident. That decision should not wait for perfect diagnosis. A credible suspicion affecting critical systems, sensitive data or essential services is enough to convene the response. The board should appoint a board-level sponsor and confirm the incident lead. In most organisations, the incident lead should be the senior executive or specialist responsible for coordinating response, not the chief executive trying to run technical containment.

At the same time, the organisation should start a decision log, preserve evidence and engage external support. Legal counsel should be involved early where privileged advice may be needed. The insurer should be notified in line with the policy, and the incident response retainer should be activated if one exists. Directors should resist the urge to issue public assurances. Early certainty is rare; early accuracy matters more.

Hour four to twenty-four: triage, contain and start the regulatory clock

The response team should establish what is known, what is not known and what decisions are needed. Containment may require isolating systems, disabling accounts or blocking access. These actions can be disruptive, but delay can be worse. Directors should ensure that containment decisions are documented and that business leaders understand the operational consequences.

Regulatory assessment should begin in parallel. Under UK GDPR, a personal data breach that is likely to result in a risk to individuals must be reported to the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it. The clock is not a reason to speculate, but it is a reason to establish the facts and record when the organisation became aware. The National Cyber Security Centre and law enforcement should also be considered, depending on the nature of the incident.

Legal privilege requires careful handling. Privilege is not created simply by copying a lawyer into an email. External counsel should instruct specialists where appropriate, and the organisation should follow a clear protocol for privileged communications. Privilege protects legal advice; it does not remove the need for factual records, regulatory assessments or operational decisions.

Day two: business continuity and the ransom question

By the second day, the board should be asking how the organisation will continue to serve customers and meet contractual commitments. Which services are prioritised? What workarounds exist? What are the dependencies on affected systems or suppliers? Who owns customer communication? Directors should ensure that recovery plans are realistic and that business units are not left to improvise.

The ransom question may arise quickly. It should not be answered in isolation by the chief executive, the technology team or the insurer. Directors should consider legal advice, sanctions implications, insurer guidance, law enforcement advice, the availability of backups, the likelihood of data recovery and the ethical and reputational consequences. Payment is not a recovery strategy, and it does not guarantee decryption or silence. A documented decision-making framework is more defensible than an urgent, uninformed choice.

Communications discipline

The organisation should speak with one voice. A single communications lead should coordinate internal messages, customer support scripts, regulator engagement, insurer updates and media handling. Holding statements should be factual and modest: acknowledge the incident, explain what the organisation is doing, and avoid technical speculation or blame.

Employees need clear guidance on what to say and whom to redirect. Customers need practical information about service impact and support. Regulators and law enforcement need accurate updates. Directors should avoid public attribution unless there is a strong operational or legal reason and the evidence is sound. Premature attribution can create new risks and complicate the response.

Common boardroom mistakes

The first is the chief executive taking operational command. Directors should provide oversight, remove blockers and make strategic decisions, not manage the incident bridge. The second is over-optimistic early assurance. Saying that customer data is safe before the facts are known can damage trust later. The third is withholding information from the insurer or legal counsel. Early, accurate disclosure is usually better than a surprise.

The fourth is treating legal privilege as a communications strategy. Privilege has a legitimate purpose, but it does not answer customers, regulators or staff. The fifth is failing to keep a decision log. In a fast-moving incident, memory is unreliable and accountability matters. The sixth is neglecting recovery resources. Containment may stop the immediate harm, but the organisation still needs to restore services, verify integrity and manage backlog.

Hour seventy-two: what good looks like

By the end of the first 72 hours, the board should have a clear picture of the incident, the response structure, the regulatory position, the business impact and the next set of decisions. There should be a documented decision log, a communications plan, an insurer engagement record and a recovery timetable. The board should also have scheduled its next cadence of meetings and identified what it needs to learn.

A serious cyber incident will test the organisation’s character as much as its technology. Calm command does not mean slow command. It means knowing who decides, what evidence is needed, what obligations apply and how to communicate without making the situation worse. Directors who prepare for those first 72 hours give their organisations a better chance of recovering with credibility intact.