Cyber Incident Response (CIR) Management

Becoming a victim of a cyber attack is an imminent reality for all companies

With punitive measures introduced by the EU GDPR (General Data Protection Regulation) and the NIS Regulations (The Network and Information Systems Regulations 2018), how an organisation responds to a cyber incident can often spell the difference between failure and success.

The speed at which you identify and mitigate such incidents makes a significant difference in controlling your risks, cost and exposure. Effective CIR management can reduce the risk of future incidents occurring, help you detect incidents at an earlier stage and develop a robust defence against attacks to potentially save your organisation millions.

For more information about cyber incident response management and the benefits of a CIR system, download our free PDF guide today

Speak to a cyber security expert

If you would like more information or advice on managing your cyber risks, speak to one of our experts and discover how we can support your organisation.

Contact us

Why do you need incident response planning?

Cyber attacks and data breaches are inevitable, so the speed at which you react to a breach is critical. Cyber criminals only need to find one weakness to infiltrate your systems, so it is essential to be prepared when a breach occurs.

The current incident response climate in organisations demonstrates why CIR is not something you can afford to ignore:


days, the average number of time that a threat has undetected access in a network. (FireEye M-Trends 2018)


of organisations don't have a cyber incident response plan in place and are unprepared to respond to a cyber attack. (PwC Global Economic Crime and Fraud Survey 2018)​​


for organisations to report data breaches/incidents under the GDPR and the NIS Regulations. The breach must be reported within 72 hours, or face heavy fines


the average cost for an organisation that has suffered a data breach. (Ponemon Institute’s 2018 Cost of a Data Breach Study: Global Overview)​

Incident reporting requirements under the GDPR and NIS Directive

Under Article 32 of the GDPR, organisations are obligated to restore availability of and access to personal data in the event of a physical or technical breach. 

Organisations in critical infrastructure also face these obligations under the NIS Directive (EU Directive on security of network and information systems), whereby OES (operators of essential services) and DSPs (digital service providers) are required to adopt incident response measures to ensure recovery following a disruptive incident.


1. Reconnaissance

  • Identify target
  • Look for vulnerabilities


  • Monitoring and logging
  • Situational awareness
  • Collaboration

2. Attack target

  • Exploit vulnerabilities
  • Defeat remaining controls
  • Architectural system design
  • Standard controls (e.g. ISO 27001)
  • Penetration testing

3. Achieve objectives

  • Disruption of systems
  • Extraction of data
  • Manipulation of information
  • Cyber security incident response planning
  • Business continuity and disaster recovery plans
  • Cyber security insurance

Frameworks that outline and require incident response measures

Incident response planning is mandated as part of all major cyber security regimes either directly or indirectly. The following standards require incident response measures: 

  • ISO 27001, the international standard for an ISMS (information security management system)
  • ISO 22301, the international standard for a BCMS (business continuity management system)
  • PCI DSS (Payment Card Industry Data Security Standard)

UK government departments also have a responsibility to report cyber incidents under the terms laid out in the security policy framework issued by the Cabinet Office, effectively mandating a CIR for such organisations as well.

Be prepared for any cyber security incident

Cyber incident response management (CIRM) service

Cyber Incident Response Management (CIRM) Service

Our CIR Management service analyses your security controls and identifies vulnerability gaps that could increase your risk exposure.

The consultancy team will develop an action plan that will allow staff to recognise potential risks and train personnel to respond to any incident in a timely and expeditious manner.

Find out more

COVID-19 Cyber Risk and Data Privacy Response Service

COVID-19 Cyber Risk and Data Privacy Response Service

A unique consultancy service helping you build a cyber resilient and privacy-compliant remote working infrastructure.

Get 3-in-1 specialist support from privacy consultants, privacy lawyers and cyber security consultants to help you build a cyber resilient and privacy-compliant remote working infrastructure

Find out more

Cyber incident response management (CIRM) training course

Cyber Incident Response Training

Find out how to effectively manage and respond to a disruptive incident, such as a data breach or cyber attack, and take appropriate steps to limit the damage to your business, reputation and brand.

This course will provide an introduction to developing a cyber incident response programme to protect your business.

Book now

Why choose IT Governance? 

  • We draw from proven incident response standards such as ISO 27035 to help you define, implement and effectively apply an incident response management programme in your organisation. 
  • We will put in place a process that allows you to determine, and report on, the specifics of a cyber incident. 
  • Our management service is tailored to your needs, business requirements and budget, making it a cost- effective solution. 
  • We have more than 15 years’ experience in helping organisations achieve local and international compliance with management system standards such as ISO 27001.
  • We have multi-disciplinary teams with project managers to roll out compliance implementation projects, and executive expertise to brief your board and develop suitable strategies.
This website uses cookies. View our cookie policy
WIN £100