Who Decides When the Systems Stop: A Boardroom Guide to the First Three Hours of a Breach

When ransomware encrypts core systems or a data breach becomes apparent, the board's first three hours are not for forensic diagnosis. They are for establishing decision rights, preserving evidence and making the calls only directors can make. The temptation is to wait for technical certainty. In practice, delay is a decision.

The first call is not the chief executive's alone

A board should not run the incident response. It should set the boundaries within which management runs it. That distinction is easiest to observe when it has been agreed before an incident occurs.

The chair, or a nominated deputy, convenes the board. The chief executive, finance director, chief information security officer or technology lead, general counsel, data protection officer and head of communications join the first call. The company secretary opens a decision log and records the time of each material decision. If the full board cannot be assembled immediately, a pre-agreed quorum of directors should be empowered to act, with full board ratification to follow.

The incident response team handles containment. The board handles authority: what management may spend, what may be shut down, who may speak publicly, and which external parties must be told. Those authorities should be written down in advance, not negotiated while systems are failing.

Minutes 0-30: verify, convene, contain

The first task is to establish whether the incident is real, material and ongoing. Management should isolate affected systems in line with the incident response plan. Staff should be told not to reset, wipe or rebuild machines without instruction. Well-intentioned attempts to restore service can destroy the logs and forensic evidence that regulators, insurers and courts may later require.

The board should ask three questions. What do we know? What do we not know? What decisions are needed now? The company secretary should capture the answers and the time they were given. A single source of truth matters more than a complete picture.

External counsel should be engaged early where legal privilege is available and appropriate. The cyber insurer should be notified in accordance with the policy, even if the full facts are not yet known. Insurers often have pre-approved forensic providers and notification deadlines. Late notice can prejudice cover.

Minutes 30-60: the calls that cannot wait

Several obligations begin to run quickly. Under UK GDPR, where a personal data breach is likely to result in a risk to individuals' rights and freedoms, the Information Commissioner's Office must be notified without undue delay and, where feasible, within 72 hours of the organisation becoming aware. The board does not make that notification itself, but it must ask the data protection officer whether the clock has started and what facts are still missing.

Regulated firms should consider their incident reporting obligations to the Financial Conduct Authority and the Prudential Regulation Authority, including under operational resilience and supervisory notification rules. Listed companies must consider whether the incident constitutes inside information under the UK Market Abuse Regulation, and whether disclosure should be made or delayed in accordance with the rules. Those are board-level judgements, taken with legal and market advice.

The board should also decide whether to engage law enforcement. Action Fraud and the National Cyber Security Centre provide routes for reporting and advice. Engagement can assist with attribution, threat intelligence and evidence handling, but it is not a substitute for the board's own decision-making.

Minutes 60-120: preserve evidence without freezing the business

Evidence preservation and operational continuity are not opposites, but they require explicit trade-offs. Management should preserve logs, disk images and memory where practicable, maintain a chain of custody, and avoid destructive remediation until forensic advice has been taken. At the same time, the board must decide which business services can be run manually, which can be paused, and which must be prioritised.

This is where a pre-agreed severity scale helps. A board should know in advance which services are critical, what manual workarounds exist, and who may authorise emergency expenditure. If the finance director must approve every overtime payment or emergency contract during the first three hours, the response will slow at precisely the wrong moment.

Communications need a single owner. Customers, staff, suppliers and regulators may all need to hear something, but not necessarily the same thing at the same time. The board should approve the posture and the thresholds for public statements, leaving drafting and delivery to the communications team.

Minutes 120-180: the decisions only the board can make

The most sensitive question is often whether to pay a ransom. That is not a technical decision. It engages sanctions law, insurance cover, legal risk, ethical considerations and the prospect of further extortion. The board should take advice from counsel, the insurer and, where appropriate, the National Cyber Security Centre, and record its reasoning. A decision to pay should never be taken by an operational team under pressure.

The board should also decide whether to shut down a critical service, whether to notify customers before regulators, whether to make a market announcement, and whether to invoke emergency borrowing or other capital measures. These are not matters to be left to the incident response team, however capable it is.

By the end of the first three hours, the board should have set a further review time, confirmed who is accountable for each workstream, and recorded the decisions taken and the information on which they were based. A short written resolution is better than a perfect memory.

Decision rights, not heroics

The measure of the first three hours is not whether the board understands the malware. It is whether the board has made the decisions only it can make, preserved the evidence it will need, and met the obligations that will not wait. A rehearsed decision-rights matrix, a named convening authority and a company secretary empowered to record decisions are worth more than a lengthy plan written during the crisis.

For UK boards, the practical test is simple: if the screens went dark this afternoon, would everyone know who decides, who is told and what must not be touched? If the answer is uncertain, the protocol needs attention now.