Frequently asked questions about incident management and cybersecurity
How can we help you with incident management and cybersecurity?
Incident management and cybersecurity
- What is a cybersecurity incident?
A cybersecurity incident is an event that affects, or risks affecting, the security of information, systems, networks or digital services.
This could include unauthorized access, malware, ransomware, data leaks, operational disruptions, or attacks against availability.
The important thing is that the organization can quickly detect, classify, manage and, if necessary, report the incident according to clear roles, processes and time requirements.
- How do you report a security incident according to NIS2?
According to NIS2, significant cybersecurity incidents must be reported to the competent authority or CSIRT according to the deadlines and procedures that apply in the national implementation, in Sweden through the Cybersecurity Act.
- early warning message
- incident report
- ongoing updates as needed
- final report
To be able to report on time, the organization needs to have an established incident process, clear criteria for what is reportable, responsible roles, decision-making paths and documented traceability for assessments, actions and communication.
- How do you report incidents according to DORA?
According to DORA, financial actors must report major ICT-related incidents to the competent supervisory authority, in Sweden normally the Financial Supervisory Authority. The reporting is done in stages through an initial report, supplementary updates and a final report. In order to clear this required clear classification criteria, responsible roles and documented traceability for decisions, actions and communication.
- What is the difference between incident management and crisis management?
Incident management is about detecting, analyzing, containing, and remediating a specific security event. The focus is on understanding what happened, mitigating the damage, restoring affected systems, and documenting decisions and actions.
Crisis management is activated when the incident has, or risks having, such a significant impact that it threatens the business's ability to function, the organization's trust, or the safety of customers, employees, or essential services.
In short: incident management handles the incident, while crisis management deals with the consequences for the business.Not all incidents become crises, but a serious cyber incident may need to be escalated to crisis management.
- How do you conduct a cyber exercise?
A cyber exercise is conducted to test the organization's ability to detect, manage, communicate, and recover from a cyber incident.
A practical approach is to define the objectives and scenario, such as ransomware, data breach, supplier incident or critical service disruption. Then determine which functions will participate, such as IT, security, operations, management, legal, communications and suppliers.
The exercise is often conducted as a tabletop exercise or technical simulation where participants are given the opportunity to handle a realistic sequence of events with new inputs over time.
After the exercise, a structured evaluation is conducted with identified strengths, weaknesses and concrete improvement measures. Most importantly, the results lead to updated plans, clearer responsibilities and better capabilities for a real incident.