CYBCybersecurity

Cyber incident: who decides, who speaks and what to preserve in the first hours

In the first hours of a cyber incident, management does not do the technical work. It takes three decisions that only it can take. It decides who leads the response, who speaks for the company and what must be preserved.

Strategic editorial team 16 September 2026 9 min read

Cover: “Cyber incident: what leadership decides”, Cybersecurity

When a cyber incident is under way, whether it is ransomware or a compromised mailbox, the technical work belongs to the people who run the systems and to the specialists called in to help. Management has three decisions that nobody else can take in its place. The first is who leads the response, and with what powers. The second is who speaks for the company, and in what words. The third is what must be preserved, because it will be needed later for notifications, for the insurer and, if it comes to that, in court. For companies within the scope of NIS2, the EU directive on network and information security, this is more than good practice. Legislative Decree 138/2024, Italy’s NIS2 law, makes the management bodies responsible for security measures. It also requires them to be informed of incidents, without delay where appropriate.

Why are the first hours a matter for management?

Because the choices to be made have consequences beyond IT. Disconnecting a server can halt production or invoicing. Alerting customers affects contracts and reputation. Calling in outside specialists costs money, and the insurance policy, if there is one, may require the insurer to be told first. No IT manager should have to decide alone, at two in the morning, without a mandate.

The incident management guidelines issued by Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) say so explicitly. Dealings with CSIRT Italia, Italy’s national computer security incident response team, may call for decisions that go beyond the role of the technical contact person. In the most serious cases, those decisions belong to the administrative and management bodies. The same guidelines make clear that appointing a CSIRT contact person delegates operational tasks, not responsibility. For NIS entities, the incident management plan must also be approved by the administrative bodies. Companies outside NIS2 have no such obligation, but they have the same problem.

Who decides, and on what?

The response works when a small group, the crisis team, operates under a mandate written in advance. It usually includes the person who leads it (the chief executive or a delegate), the IT manager, a lawyer, the person in charge of communications, someone who knows production and, when needed, outside specialists. Every role has a stand-in.

The mandate sets out in advance what the person in charge of the response can do without seeking further approval. The table summarises the typical decisions.

Decision	Who takes it	When	What is needed to decide
Isolating systems and blocking suspicious accounts	The IT manager, within the mandate	Immediately	A list of critical systems and administrator accounts
Stopping a production line, a site or a customer-facing service	The head of the crisis team	In the first hours	The impact on operations and contracts
Calling in outside specialists and notifying the insurer	The head of the crisis team	In the first hours	Contracts already signed and the policy conditions
Notifying CSIRT Italia and the Italian Data Protection Authority (Garante)	Leadership, on the proposal of the CSIRT contact and the data protection officer	Within the legal deadlines	Initial evidence and an assessment of the impact
Informing customers and suppliers	Leadership, with the lawyer	After the initial assessment	Established facts and contractual obligations
Responding to a ransom demand	Leadership, with lawyers and specialists	Never on impulse	The state of the backups, the data stolen and legal constraints

Every decision is recorded in a decision log, with the time, the author and the reason. Weeks later, that log is what allows the company to answer the authority, the insurer and the board of directors. The first mistake to avoid is switching systems off on impulse. CISA’s #StopRansomware Guide only recommends powering down devices that cannot be disconnected from the network, and the decision rests with the crisis team.

Who speaks, and in what words?

There is one voice for the outside world and one message for the inside. The first notice to employees says what to do and what to avoid. Nobody switches off or reinstalls anything on their own initiative. Nobody comments on social media or in messaging groups. Everyone reports strange emails and phone calls. If the company email may be compromised, the crisis team coordinates on alternative channels chosen in advance. The NIS decree lists secure emergency communication systems among the security measures, where appropriate.

With customers and suppliers, precision counts. The NIS decree provides that, after consulting CSIRT Italia and where appropriate, the recipients of the company’s services are informed of incidents that may affect them. Many contracts also require notice within a set deadline, which must be checked at once. You say what you know, what you are doing and when the next update will come. Statements such as “no data has been taken”, made before the checks are complete, are the hardest to withdraw.

A typical scenario. One Monday morning, the accounts department discovers that invoices with altered bank details have been sent from a colleague’s mailbox. The most urgent decision is not a technical one. It is to phone the customers involved, from numbers they recognise, before they pay. It is also to ask the bank to stop any transfers that can still be stopped.

Which notifications does leadership decide, and on what timescale?

The deadlines are set by law and run from the moment the company becomes aware of the incident. The technical contact prepares the notifications. Leadership decides and signs.

Recipient	Who notifies	Deadlines	When it applies
CSIRT Italia, through the ACN portal	NIS entities, for a significant incident, meaning one with a serious impact on services or on third parties	Early warning within 24 hours, notification within 72 hours with an initial assessment, final report within one month	Entities on the 2025 list: nine months after ACN notifies them. Entities on the 2026 list: 1 January 2027
Italian Data Protection Authority (Garante)	Every data controller, if personal data is involved, unless the breach is unlikely to result in a risk to people	Without undue delay and, where feasible, within 72 hours (GDPR, Article 33)	Already in force
The people affected	The data controller, if the risk to them is high	Without undue delay (GDPR, Article 34)	Already in force
Polizia Postale e per la sicurezza cibernetica, the Italian State Police’s cybercrime unit	Every company, when the incident is a crime	By filing a criminal complaint, as soon as possible	Always

The NIS decree makes clear that notification does not expose the company to any greater liability than that arising from the incident itself. For San Marino companies the framework is different. Personal data is governed by Law 171 of 21 December 2018, and everything else must be assessed case by case.

What must be preserved, and why?

Everything that helps reconstruct what happened must be preserved. NIST, the US standards body, and ACN ask for the same thing in different words. Evidence is gathered first, and the cleaning up comes afterwards. For management the rule becomes a precise instruction. No system is reinstalled until the person in charge of the response confirms that the evidence is safe. The evidence will be needed for the final report to CSIRT Italia, which must state the likely cause. It will be needed for the records the GDPR requires for every personal data breach, even when the breach does not have to be notified. It will also be needed for the insurer.

The evidence to secure falls into four categories:

logs from firewalls, remote access, email, authentication and applications. Some systems keep them for only a few days, so they must be copied immediately
disk and memory images of the affected systems, made by specialists
suspicious emails with full headers, the attackers’ messages, and screenshots showing the date and time
the action log, which records who did what, when and on which system.

How to collect the evidence, and the chain of custody that preserves its value in court, are described in the Observatory guide to ransomware. How long to keep logs, and where, is explained in the article Sherlock Holmes and the log files.

How does management prepare before it happens?

It takes little, as long as it is done in advance.

A two-page mandate for the crisis team. It names the members and their stand-ins, sets the powers to spend money and to shut things down, and says who decides on notifications.
A contact list on paper. It covers incident response specialists, the lawyer, the insurer, the bank, critical suppliers, CSIRT Italia and the Polizia Postale.
A careful reading of the contracts, to find the notice periods owed to customers, the suppliers’ obligations and the conditions of the insurance policy.
A tabletop exercise with leadership. A simulated scenario is discussed around a table to find out where the plan does not hold. For NIS entities, the ACN measures require the plan to be reviewed at least every two years and after every significant incident.

In brief

In the first hours, management decides who leads the response, who speaks and what is preserved. The technical work stays with the specialists.
In companies subject to NIS2, the administrative bodies are accountable for security measures and approve the incident management plan.
A small crisis team works under a mandate written in advance and records every decision in a log.
The deadlines for notifying the authorities are fixed. For NIS entities, the reports to CSIRT Italia are due within 24 hours, 72 hours and one month. Where personal data is involved, the Garante must be notified within 72 hours where feasible.
No system is reinstalled before the evidence is safe.
The mandate, the contact list, the contract review and the exercises are prepared before they are needed.

Frequently asked questions

Should the board be told immediately?

In companies subject to NIS2, the decree requires the management bodies to be informed of incidents and notifications, periodically or, where appropriate, promptly. For an incident that could halt operations or involve customer data, telling the board immediately is the prudent choice even outside NIS2.

Should you tell customers straight away that there has been an attack?

It is wise to communicate what has been established early, especially if customers need to do something to protect themselves, such as not paying suspicious invoices or changing their credentials. Timing and content are decided with the lawyer, taking account of the contracts and of any guidance from CSIRT Italia.

Writing the crisis team’s mandate, preparing the plan and testing it in an exercise with leadership, before it is needed, is part of the incident management provided by Strategic’s Cybersecurity division. The division also carries out forensic analysis when an incident has already happened. The contact form on this website is not an emergency channel. During an incident, use the contacts written into your own plan.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.