Attack scenarios
Ransomware, email account takeover, a compromised supplier and loss of a key system, each with a decision path.
Business Continuity Plan for
Cyber Attack
A cyber attack business continuity plan keeps your organisation operating, and brings systems back in the right order, when ransomware or another attack takes email, files or core systems offline.
BCP for Cyber Attack
What it is
A continuity plan built around the way cyber attacks actually unfold: systems go down without warning, backups may be damaged, staff cannot email each other and a data breach clock starts. It covers recovery order, workarounds, communication and legal notification. The service is documentation only and does not include drills.
Why organisations need it
A general continuity plan assumes the building is unavailable but the systems are safe. In a cyber attack it is the opposite: the building is fine and nothing works. Email may be down, so the call tree on the shared drive is unreachable. Backups may be encrypted along with everything else. Customer data may be stolen, which starts the PDPA notification clock. Plans written for floods and fires do not cover this, and organisations find out when it is too late.
What the engagement covers
Critical activities and recovery order
The activities that cannot stop, the minimum systems and data each needs, and which come back first, second and third, with recovery time targets.
Manual workarounds
Paper, phone and spreadsheet procedures so key work continues while systems are down.
Out-of-band communication
Contact lists and channels that do not depend on the affected email or network.
Decisions and notification
Who authorises shutting systems down, calling in help, contacting the police and notifying the Commissioner within 72 hours and affected individuals within 7 days where required.
Backup readiness review
Whether backups are kept offline or immutable, who can reach them and whether a restore has ever been tried.
What the business gets out of it
Keep trading during an attack
Staff know what to do by hand while IT recovers systems.
Faster, orderly recovery
Systems return in the order the business needs, not the order IT happens to find them.
Fewer costly mistakes
Pre-agreed decisions on shutting down, paying or not paying and who may speak publicly.
Breach duties covered
PDPA notification steps are built into the plan.
Decisions written down
Who decides what is agreed before an attack, not during it.
How it works
How the engagement runs
01
Scope and critical activities
Agree the activities and systems that matter most.
02
Impact and dependencies
Short workshops to set recovery priorities and targets.
03
Plan and playbooks
Write the continuity plan and cyber attack playbooks.
04
Backup and recovery review
Check how backups are kept and tested, and note gaps.
05
Review and hand-over
Management reviews the plan and your team is walked through it.
Deliverables
What you receive
Cyber attack continuity plan
Scenarios, roles, recovery order and decision rights.
Manual workaround procedures
Step-by-step fallback for each critical activity.
Out-of-band contact sheet
How to reach the team when email and network are down.
Backup and recovery gap list
Findings and fixes, prioritised.
Management summary
A short summary of the plan, gaps and next steps.
Who it is for
Who this is built for
Industries
Company sizes
Departments
What is included and what is not
| Item | Status | Detail |
|---|---|---|
| Cyber attack continuity plan | Included | Scenarios, roles, recovery order and decision rights. |
| Manual workaround procedures | Included | Fallback steps for each critical activity. |
| Out-of-band contact sheet | Included | How to reach the team when email and network are down. |
| PDPA notification steps | Included | Built into the plan. |
| Backup readiness review | Included | Practical review, with gaps and recovery times noted. |
| Drills and exercises | Not included | Documentation only. |
| System restoration, forensics, ransom negotiation | Not included | Stays with your IT team, vendors or an incident response provider. |
FAQ
FAQ
Incident response is the technical and security team's playbook for detecting, containing and investigating an attack. This service is about the business: keeping operations running, recovering in the right order, deciding who says what and meeting notification duties. The two should fit together, and we can do both.
No. We do not carry out forensic investigation, system restoration or ransom negotiation. We plan the business side and review your backup readiness at a practical level. Technical recovery stays with your IT team, vendors or an incident response provider.
No. We can start with the cyber attack scenario, which is the one most likely to hit, and extend to other disruptions later. If you already have a general plan, we add the cyber attack scenarios to it.
At a practical level: whether copies are kept offline or immutable, who has access, whether restores have been tested and how long a full restore would take. Technical testing stays with IT, and we record the gaps and recovery times the plan must assume.
Usually three to five weeks. A smaller organisation can be faster.