Why a plan is critical
An attack brings stress, uncertainty, and time pressure. Who needs to be notified? Should computers be shut down? Who talks to customers and the media? Without a plan, you lose valuable time, and the wrong decisions can make the damage worse.
What the plan should cover
A good plan doesn't need to be long. It should spell out who is responsible, who to contact – both internally and at your IT provider – how to isolate systems, and how you'll communicate when email and Teams may be down.
Notification and obligations
In the event of a personal data breach, your business must generally notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours of discovering the breach. Businesses covered by the Norwegian Digital Security Act (digitalsikkerhetsloven) also have separate notification obligations.
What we recommend
- Write a short incident response plan with names and phone numbers
- Keep the plan accessible outside your regular systems
- Clarify roles with your IT provider in advance
- Practice the plan at least once a year
How we can help
Wondering what this means for your organization? Let's talk.
Request a meeting →