The UK's National Cyber Security Centre (NCSC) has published a detailed guidance document designed to help organizations hit with a cyber-attack that “disrupts, disables or damages” their critical systems.

The document, What To Do When Cyber-Attacks Disrupt Your Organisation, is split into three sections, reflecting the three main chronological stages following an attack.

These are:

• The first few hours and days, which includes “swift defensive actions, establishing governance and getting control of communications.” The NCSC recommended organizations engage an incident response firm vetted by the agency at this stage
• Building and implementing a recovery program in a way that gets the organization back to minimum viable operations (MVO). This may require temporary workarounds
• Longer term recovery to business as usual, which involves addressing the issues that caused the incident and rebuilding in a more secure and resilient way

Read more on incident response: NCSC Urges Fortinet Customers to Tackle FortiBleed Fallout

The NCSC’s CTO for economy and society, Ralph B, explained in a blog post on July 27 that the best course of action is to prepare for incidents before they take place, so that recovery and response is faster.

“It’s a bit like training for a marathon. Reading about the race, buying the right equipment and writing a training plan are a good start. But it’s the actual running – regularly putting in the miles and building endurance – that prepares you for race day,” he said.

“In the same way, it’s vital that organizations don’t just document a plan, but actually practice and test their response to disruptive incidents. Testing failover systems, rehearsing shutdown and restart procedures, and rebuilding systems from backups can all provide valuable real world lessons.”

In this regard, realistic simulation exercises are more useful than tabletop approaches, as they help organizations build the “muscle memory” they need  to respond effectively under pressure, he continued.

Attacks More Likely Than Ever

The guidance is well timed, given escalating threat levels.

Data released by ManageEngine earlier this year revealed that 77% of British organizations suffered a cyber incident over the past year, 11% above the European average.

The NCSC has repeatedly urged organizations to invest in resilience measures, arguing that rapid technological change, geopolitical uncertainty, and the evolution of the threat landscape have made these perilous times for security teams.

It recently warned that AI is already helping adversaries conduct offensive activity at much greater speed and scale than before, reducing the time available for defenders to respond, detect and contain threats.

Earlier in July, the NCSC announced new plans for a national cyber-defense capability powered by agentic AI, claiming that threat actors will soon be able to launch “fully autonomous attacks operating across the complete intrusion lifecycle.”