Actions to Take After an Attack
Actions to Take After a Cyber Attack
No organisation wants to experience a cyber attack, but having a clear plan for what to do after one occurs is just as important as trying to prevent it. When a breach happens, a slow or disorganised response can be just as damaging as the attack itself.
There are five actions that should be followed in sequence.
Investigate
Before anything else, the organisation needs to work out exactly what has happened. This means establishing the severity (how serious is it?) and the nature (what kind of attack was it?) of the breach.
For example, was it ransomware that has encrypted files across the whole network, or was a single employee's account accessed without authorisation? The investigation team — typically IT security staff — will examine system logs, affected devices, and any alerts from security software.
This stage is critical because every decision that follows depends on having accurate information. Acting on assumptions rather than evidence can make the situation significantly worse.
Unlock All Revision Notes
Syllabus-perfect, clutter-free summaries — so you only study what really matters.
Start your 7-day free trial (no card needed!)Existing User? Sign In