Prepare your incident response
Short label: RESPONSE
Meaning
Agree who does what when an incident is suspected: assess, contain, preserve records, communicate and recover.
Why it matters
A prepared plan helps people act consistently under pressure.
What you can do
Keep a contact list and first-hour plan, then rehearse a realistic incident. Assess any legal reporting duty using the incident’s facts and applicable rules.
Services that can help
Device Shield and Web App Shield provide agreed protective actions and records. Workshops rehearse the plan. Response timing and included support are contractual arrangements.
Official reference — NIS2 Art. 21(2)(b)
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)
(b) incident handling;
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)(b)
When something happens, you must be able to detect it, contain it, fix it and learn from it — people, steps and tools decided in advance.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.