Crisis and continuity 18 October 2026
All articles.
Crisis and continuity 3 October 2026
How do you prevent a second attack straight after an incident?
To prevent a second attack after an incident: fix the entry point, rotate every exposed credential, hunt for persistence and keep monitoring closely.
Read → Crisis and continuity 2 October 2026
What happens after incident response?
After incident response comes remediation, the final report, follow-up notifications, lessons learned and closer monitoring. Here is what to expect.
Read → Crisis and continuity 1 October 2026
Can you hire an incident response provider without a contract in place?
In an emergency, an incident response provider first has you sign an engagement agreement. Cyna's incident response on-call team is available 24/7.
Read → Crisis and continuity 30 September 2026
Do you need an external incident response provider, or is your in-house team enough?
For a serious incident, an in-house team alone is rarely enough: it knows the systems, a provider brings forensics and coordination. How to split the work.
Read → Crisis and continuity 29 September 2026
What does an incident report contain?
An incident report covers a summary, timeline, scope, root cause, actions taken, impact and recommendations. What to include and what NIS2 and GDPR expect.
Read → Crisis and continuity 28 September 2026
How do you know the attacker is gone?
You never know for certain: you build a body of evidence through investigation, coordinated eviction and enhanced monitoring. How responders reach a verdict.
Read → Crisis and continuity 27 September 2026
When can you restart production after a cyberattack?
Restart production once the attack is contained, the entry point closed, systems rebuilt clean and monitoring stepped up. The criteria to check before you go.
Read → Crisis and continuity 26 September 2026
How do you contain a system without destroying evidence?
Cut the network without powering down, collect memory before disk, delete nothing: how to contain a compromised system without destroying the evidence you need.
Read → Crisis and continuity 25 September 2026
What should you do in the first hours of a cyberattack?
Isolate without switching off, raise the alarm, mobilise the response team and preserve evidence: what to do in the first hours of a cyberattack.
Read → Crisis and continuity 24 September 2026
Who is on an incident response team?
SOC analysts, CERT experts, the MSP, management, legal and communications: incident response team roles explained, and who decides what during a cyber incident.
Read → Crisis and continuity 23 September 2026
How long does incident response take?
Hours to contain, days to investigate, sometimes weeks or months to remediate: how long incident response takes, and the factors that make it shorter or longer.
Read → Crisis and continuity 22 September 2026
What are the steps of incident response?
Preparation, detection, containment, eradication, recovery and lessons learned: the incident response steps explained, in line with NIST SP 800-61 Revision 3.
Read → Crisis and continuity 21 September 2026
How does incident response work?
Alert, triage, containment, investigation, eradication, recovery and lessons learned: how incident response works in practice, step by step, and who does what.
Read → Crisis and continuity 20 September 2026
Does incident response include data recovery?
Incident response steers recovery and checks systems are clean, but restoring the data itself relies on your backups and your IT team or MSP. Who does what.
Read → Crisis and continuity 19 September 2026
What are the different types of cybersecurity incidents?
Ransomware, email compromise, data breach, denial of service, intrusion: the main types of cybersecurity incidents and what each one means for the response.
Read → Crisis and continuity 18 September 2026
What is an incident response retainer?
An incident response retainer reserves expert help before an attack happens. What it includes, what drives its cost and the questions to ask before signing.
Read → Crisis and continuity 17 September 2026
Who should you contact after a cyberattack?
Your MSP or incident response provider first, then the police, the data protection authority, your national CSIRT and your insurer. Who to call, and when.
Read → Crisis and continuity 16 September 2026
What does an incident response service cover?
An incident response service covers triage, containment, investigation, eradication, recovery support and a report. What is usually included and what is not.
Read → Crisis and continuity 15 September 2026
What is a PRIS-qualified incident response provider?
PRIS is the French ANSSI qualification for incident response providers, assessed against a public framework. What it covers, its two levels and when to ask.
Read → Crisis and continuity 14 September 2026
What is the difference between incident response and crisis management?
Incident response deals with the attack technically; crisis management steers its impact on the business. Roles, triggers and how the two fit together.
Read → Crisis and continuity 13 September 2026
What is a cybersecurity incident?
A cybersecurity incident compromises the availability, integrity or confidentiality of data or services. The NIS2 definition, examples and reporting thresholds.
Read → Crisis and continuity 12 September 2026
CERT, CSIRT and SOC: what are the differences?
CERT and CSIRT describe the same incident response team, while a SOC monitors and detects around the clock. How the roles compare and how they work together.
Read → Crisis and continuity 11 September 2026
What is a CERT in cybersecurity?
A CERT is a team that responds to cybersecurity incidents, not a certificate or a certification. What it does, the main types of CERT and how to call on one.
Read → Crisis and continuity 10 September 2026
What is incident response in cybersecurity?
Incident response covers everything done to detect, contain and eradicate a cyberattack, then restore operations. Definition, phases, roles and legal framework.
Read →Want to discuss it
with an expert?
We take stock of your situation. Cyna is the team that operates what you have already bought.