Cyber Crisis Decisions Every Leadership Team Must Be Ready to Take
Understanding the C‑Suite’s role begins with recognising the decisions a cyber crisis forces senior leaders to take. These fall into several distinct areas, each with its own pressures, timelines, and stakeholders.
- Crisis communication: Who is told what, and when? Staff, customers, partners, media, and regulators all have different needs and different legal entitlements to information. The sequencing of these communications, and the tone in which they are delivered, can significantly shape both regulatory outcomes and long-term reputational damage. Getting this wrong —either by saying too much too soon or too little too late — compounds the original incident.
- Regulatory and legal obligations: Under NIS2 and GDPR, organisations operating in Europe face mandatory breach notification timelines that are measured in hours, not days. The decision about when a threshold has been crossed, and what must be reported to whom, is not purely a legal question — it requires executive judgment about the nature of the incident and the organisation’s obligations. The cost of getting this wrong includes significant fines and personal liability for directors.
- Ransom and negotiation decisions: If ransomware is involved, the question of whether to engage with threat actors, and on what terms, is one of the most consequential decisions an executive team will face. It is a risk management decision, a financial decision, and a values decision simultaneously. It cannot be delegated to IT, and it should not be made without preparation and expert advice.
- Operational continuity: Which functions are critical? What manual workarounds exist? What is the acceptable downtime for each part of the business? These are questions that require executive knowledge of the organisation’s priorities — and they need answers quickly, often before the full scope of the attack is understood.
- Board and investor communication: Your board and, if applicable, your investors and lenders need to be informed and managed through a serious incident. How and when this happens, and what you tell them, carries its own legal and governance dimensions that deserve careful advance thought.
Effective C-Suite Cyber Threat Preparedness
The organisations that handle cyber crises well are usually those with leaders who have thought through the hard questions in advance, established clear decision-making protocols, and practised making fast, aligned calls under pressure
Impact without external assistance |
Impact with external assistance |
|
21 days average downtime for companies hit by a ransomware attack |
12.5 days average downtime for companies hit by a ransomware attack |
|
80% experience a follow-up attack after paying a ransom |
5% experience a follow-up attack after paying a ransom |
|
$0 is the average amount the ransom is lowered |
up to 80% is the average amount the ransom is lowered |
Data from Delta Crisis Management
This is the essence of executive cyber crisis management: not eliminating the possibility of an attack, but ensuring that when one occurs, the leadership response is controlled, coordinated, and competent.
Genuine preparedness requires more than a plan on paper. It involves realistic exercises that surface the gaps between what executives assume they will do and what the pressure of a live incident demands. That includes knowing which external partners—legal, communications, negotiation—you will call, and having those relationships established before you need them.
The right starting point is an honest assessment of where the gaps are — enabling them to be dealt with before an incident occurs.
CSIS Services: Executive Crisis Readiness
Prepare your organisation to respond effectively. Developed in collaboration with one of our partners, Delta Crisis Management, our Executive Crisis Readiness programme enables your leadership to make fast, aligned decisions when a cyber crisis threatens your organisation.
