The first hour of a cyber incident: who does what?

The decision behind the headline

This review focuses on incident triage, specialist access, management authority and safe communication.

In the fiduciary scenario, distinguish an unusual login from confirmed copying of files. Ask the technical lead to preserve the authentication records and identify accounts, systems and time windows potentially involved. Management should nominate someone to approve containment decisions while a separate person maintains a factual incident log. If ordinary email may be compromised, establish a clean contact route before circulating sensitive findings. Repeated speculation can confuse the response and create inaccurate client messages.

A hypothetical scenario to test

A fiduciary sees unusual logins and cannot tell whether client files have been copied. This is an invented example, not a reported claim or a promised payout. Reconstruct the sequence from the first sign of trouble to ordinary service resuming. Ask what would happen if the problem occurred during a holiday or at the busiest time of year. The stress test should expose assumptions about availability and timing before they are relied upon.

Ask the cyber insurer which responder can be mobilised and how authority works outside office hours. Check whether the appointed team covers investigation, recovery and legal assessment or coordinates separate specialists. Do not assume the hotline gives immediate access to every service at an unlimited fee. Run a rehearsal where the principal IT contact is on holiday: who can isolate access, retrieve the latest clean inventory and obtain the business owner’s decision? The first-hour objective is controlled facts and accountable action. Compensation is a later question; delaying containment because eligibility is unresolved can leave the technical incident growing while the insurance file remains incomplete.

Identify the contractual boundary

Avoid destroying evidence through improvised reinstallations. A qualified incident responder should coordinate containment and preservation. Use a clean communication channel if email may be compromised, and separate authority to shut down systems from authority to accept legal or commercial commitments.

Compare the wording, then the price

Use an identical scenario with each insurer and request clarification of hotline availability, appointed responders, approved expense rules and forensic services. Ask for the relevant clause and a written explanation of anything left uncertain. An optional extension should appear in the schedule, not merely in a sales discussion.

Reduce the exposure before transfer

A useful first action is to prepare an offline escalation sheet and practise decisions with your IT provider. Assign an owner, a completion date and a simple test of whether the measure works. Written procedures matter only if staff can find and use them under pressure.

Evidence and the next review

Prepare system logs, timestamps, contact records and the latest network inventory. Date the records and keep an accessible copy away from the affected process. Keep offline access to the insurer contact, incident plan and supplier escalation list. A claim notification does not replace any required regulatory notification. Review the arrangement when your activity, technology, locations or counterparties change.