Respond

Respond is the post-attack action of informing and updating stakeholders and other interested parties about an attack and its progress. Stakeholders are the people or groups with an interest in the organisation, such as its staff, service users or volunteers. The response should vary with the severity of the attack: a minor issue might need only a short internal message, while a serious one may need quick contact with affected people and outside authorities.

For example, a community theatre finds that its booking system has been attacked and customers' names and phone numbers may have been copied. Because personal data may be exposed, the theatre emails affected customers, explains what is known so far and tells them to be wary of unexpected calls or messages asking for money. It also reports the incident to Action Fraud and, where required, to the Information Commissioner's Office. As more information emerges, the theatre posts updates on its website and contacts ticket holders again when it has clearer advice.

Respond includes informing appropriate authorities and law enforcement where the law or the seriousness of the attack requires it. It also means keeping interested parties updated as containment and recovery continue, so nobody is left relying on rumour. Informing stakeholders can damage public image, because it draws attention to the organisation's weakness. However, failing to inform authorities can lead to legal action and fines. The benefit of responding well is that stakeholders and authorities are aware and involved, which supports legal compliance and reduces harm.