COMPLYZARD
Try 1 month free

Cyber disruption response and recovery guide

Document preview17 pages
Download
Cover of Cyber disruption response and recovery guide
Page 1 of 17

Download this document free

Get this document with your free trial. Choose from the full Complyzard library.

Try 1 month free30 days free, then $19/month. Trial terms apply. Card required. Cancel anytime.
Document information
ByNational Cyber Security Centreteal_orbit_18e497

NCSC guidance for immediate incident command, investigation, recovery to minimum viable operations and the longer-term rebuild after a highly disruptive cyber attack.

Adapted edition

Business continuityContinuity and responseIncident response
Document type
Assessment Guide
Format
DOCX
Pages
17
Language
English
Version
1.0
Updated
2026-09-16
Category
Information security
Licence
Open Government Licence v3.0
Description

Scope: NCSC guidance for leaders and cyber teams responding to highly disruptive attacks on critical digital systems. It focuses on operational disruption, is non-mandatory and is not an exhaustive checklist. Legal and regulatory duties vary by organisation and jurisdiction; obtain advice tailored to the incident.

Contents
  • 1. Immediate activities
  • 2. Recovery and ongoing investigations
  • 3. Rebuild
Source and licence
What to do when cyber attacks disrupt your organisation

National Cyber Security Centre

Original source OGL-UK-3.0

AttributionNational Cyber Security Centre, What to do when cyber attacks disrupt your organisation (28 July 2026), text under Open Government Licence v3.0.

ChangesAdapted 16 September 2026: transcribed the licensed text of the 33-page PDF into a neutral editable document and reading PDF. Retained the three response phases, activity and workstream labels, lists, source contents and external reference destinations. Deduplicated a phase-2 subtitle in this edition; omitted the extra HR heading printed alongside 2.2.11 Financial modelling in the source PDF; corrected Ransome to Ransom and capitalized Workforce in headings; and joined one split source-PDF bullet. These narrow wording and list corrections were checked against NCSC's corresponding HTML. Removed two false source-contents rows: a repeated HR entry and a Log learning bullet mislisted as a section; their actual body content remains. Photographs, infographics, publisher marks and decorative layouts were omitted.

Version history
  • v1.016/09/2026
Report this document