You've just been hit by a cyber attack - does everyone know what to do?

Cybersecurity related policies (including what needs to be done when an attack occurs and the role that each team member - including IT providers - must play) should be in place well before an actual attack occurs.

Once an event has been discovered, your team must know what to do. The response will largely depend on the threat detected. For example, the receipt of a phishing e-mail will have a very different response than a ransomware attack.

A solid response plan will ensure that all of the appropriate resources are engaged as quickly as possible, and that they fully understand their responsibilities. At the onset of an attack is not the time for surprises (IT supplier isn't available, backups failed etc.).

As soon as a threat is detected, it should be logged and all steps taken to mitigate the impact should be documented.