A cyber incident is rarely a technical problem for long. Within minutes, it becomes a leadership problem: stop operations or keep running, isolate networks or preserve continuity, notify or investigate, speak or stay silent. In that moment, the organisation does not rise to the level of its policies. It falls to the level of its practice.
NIS 2 and DORA make this brutally clear. They do not reward good intentions. They expect governance, speed, evidence, and repeatable execution. If your response is improvised, your exposure is not only operational and reputational. It is regulatory and personal.
The uncomfortable truth
Most organisations believe they are ready because they have:
an incident response document
a crisis committee on paper
an IT team that “knows what to do”
That confidence collapses in the first 60 minutes, when:
nobody is sure who can shut down a plant, cut a supplier connection, or pull the plug on remote access
legal, communications, operations and IT argue with different priorities
executives ask for a clear situation report and receive fragments
What Board members and executives must demand
You need four things, and none of them are optional:
Decision rights, in writing, rehearsed
A single executive situation report
A notification and evidence workflow
Proven recovery capability
The key action plan (simple, non-negotiable)
Adopt these actions at the leadership level:
Run a Board-level tabletop at least once per year focused on executive decisions (shutdown, public statement, regulator notification posture, supplier failure, ransom scenario).
Run a cross-functional crisis simulation at least once a year, involving Operations, Legal, Communications, HR, Finance, and key vendors, in addition to IT.
Measure readiness with four metrics (Time to convene the crisis, team, Time to first containment decision, Time to first regulator-ready incident summary, Time to restore critical operations against business tolerances)
Turn lessons into funded remediation within 30 days: playbooks, escalation, technical controls, and governance gaps.
Why this matters now
Attackers industrialise. Regulators formalise. Boards are expected to demonstrate oversight, not commentary. Under NIS 2 and DORA, “we were not ready” is no longer an explanation. It is a failure of governance.
How DigiSôter can help
DigiSôter designs and runs executive tabletop exercises and full crisis simulations aligned to NIS 2 and DORA expectations, tailored to your business reality (IT, OT, suppliers, plants, shared services).
Our deliverables are executive-ready:
Scenario design based on your risk profile and critical services
Facilitation with realistic injects and time pressure
Decision log and evidence pack to strengthen compliance posture
After-action report with a prioritised remediation roadmap and quick wins
Optional support to drive the transformation until closure
If you want a crisis response that performs under pressure, test it like a business capability, not like a document.