Answers
Names who is responsible for each task and how quickly systems must be restored after an attack.
Establish the type of attack, how serious it is, when it happened and which systems are affected.
Contain the threat by isolating infected systems or blocking malicious traffic to prevent it spreading.
Bodies such as the police and the National Crime Agency that are told about a serious breach.
Inform employees, customers and other affected parties about the attack and keep them updated.
Restore systems and data from backups so the organisation can keep working while security weaknesses are fixed.
Longer-term changes such as new hardware, software, device hardening and staff training after an attack.
Review what went wrong, how it happened and whether it could have been prevented to improve policies.
A rating from low risk to severe that decides how complex the organisation's actions need to be.