The opening hours of a significant cyber incident can involve incomplete information, operational disruption and rapidly increasing pressure from multiple stakeholders. This advanced course examines how managers and organisational leaders can structure decision-making during the first 72 hours of a cyber incident. It focuses on command, escalation, priorities and coordination rather than technical incident remediation.

Participants work through incident scenarios requiring decisions about authority, business continuity, internal communication, external advisers, information requirements and stakeholder response. The course explores how effective incident structures can reduce confusion and prevent competing teams from acting without coordination. Participants develop a clearer understanding of the decisions leaders must be prepared to make before an incident occurs.