For a financial business, a security incident is also a regulatory and reputational event. In the EU, the Digital Operational Resilience Act (DORA) has applied since January 2025 and sets expectations for ICT incident management and reporting. Whatever your obligations, these are the basics to have in place before you need them.
A written plan people have actually read
Who declares an incident, who leads, who decides on shutting systems down and who speaks to clients. Keep it short enough to use under pressure.
Contact lists that work at 3 a.m.
Internal decision-makers, IT and security providers, legal counsel, insurers and the relevant regulators, with out-of-hours numbers and a channel that does not depend on your own email.
Logs you can rely on
Centralised, time-synchronised logs from critical systems, kept long enough to investigate. Without logs, forensics becomes guesswork.
Backups you have restored
Offline or immutable backups of critical data, with a restore that has been tested recently. An untested backup is a hope, not a control.
Notification rules mapped in advance
Which incidents must be reported, to whom and how fast, including regulators, data-protection authorities and partners. Prepare templates so you are not drafting from scratch.
Practice
Run a tabletop exercise at least once a year with management in the room. It is the cheapest way to find the gaps in everything above.
Incidents are judged less by whether they happened and more by how well you responded.
We can review your readiness, run an exercise with your team and stand by to help if something happens.
General information only, not legal or regulatory advice for your specific situation.