Who Picks Up at 2am? A Cyber Response Model Built for Seven Entities, Not One

Almost every mid-market group has a cyber incident response plan. Fewer have a plan that describes the organisation they actually operate. The typical document was drafted by the largest trading company, reviewed by the largest trading company, and rehearsed in a room containing the largest trading company's IT director, its finance director and a representative from the insurer.

Then the intrusion lands in the smallest subsidiary, at a facility that shares a Microsoft tenant with three other companies in the group, and the response runs into a structure the plan never contemplated.

The single-entity assumption is the defect

A playbook written for one company assumes one board with clear authority, one bank account, one brand, one regulator, one insurer and one set of customer contracts. A seven-entity group has all of those things several times over. The predictable consequences are familiar to anyone who has sat through the aftermath: two forensic firms engaged in parallel, three versions of the same holding statement, an insurer notified four days late, and a subsidiary managing director who has already emailed two customers before anyone at the centre knew there was an incident.

The problem is not a shortage of technical controls. It is an absence of decision rights, and it will not be solved by buying another monitoring tool.

Give one person the authority, in writing

A group needs a named incident commander and a named deputy, appointed by the group board rather than agreed in principle between operating companies. That person should be able to declare a group-level incident without seeking consent from each subsidiary, because the alternative is a conference call at 2am in which six managing directors negotiate.

Three supporting instruments make the appointment real:

• A severity scale with objective triggers. Data exfiltration, ransomware on a shared platform, loss of a payment run, and any incident touching more than one entity should each escalate automatically. Judgement should determine the response, not the escalation.
• Pre-delegated spend authority. Forensic retainers, external counsel and temporary infrastructure cost money quickly. A standing authority, capped and recorded, removes the most common cause of delay in the first six hours.
• A decision log. Every material decision, its time and its owner, recorded contemporaneously. It is invaluable to regulators, insurers and, if it comes to it, litigation.

Make escalation compulsory and blameless

Subsidiary leadership should be the first reporter, not the incident owner. Group policy should require notification within an hour of suspicion, not confirmation, and it should state plainly that a false alarm carries no disciplinary consequence. Groups that punish over-reporting get fewer reports, and the ones they get arrive late.

Just as important is the reverse direction. Subsidiary managing directors need to know what will happen to them: who will communicate with their staff, whether trading will be suspended, who controls their customer messaging, and when they get their systems back. Ambiguity here produces the parallel universes that make a group incident so much more expensive than it needed to be.

Map the clocks before they start

The notification obligations of a group are not the same as those of a single company, and they do not run to the same timetable. A properly maintained matrix should list, for each entity, the regulator, the trigger, the deadline and the nominated notifier. It should cover at least the following:

• The Information Commissioner's Office, where personal data is affected, on its 72-hour framework.
• Sector regulators, where the entity is authorised or supervised, following the specific reporting duties that apply to it rather than a general assumption.
• Contractual notification to major customers and to any managed service provider in the affected supply chain, noting that a supplier's breach can trigger the group's own obligations.
• Insurers, within the timeframe stated in the policy, and through the channels the policy requires.
• Law enforcement reporting channels, and any sanctions or legal considerations that arise if a ransom demand is received, which should be escalated to counsel immediately rather than handled operationally.

Two practical points are routinely missed. First, notification duties frequently sit with a regulated subsidiary rather than the group parent, so the matrix must name entities rather than the group. Second, where a group uses a shared service company for payroll, HR or finance, an incident there may trigger obligations across every entity at once.

One voice, several brands

Groups with distinct consumer or trade brands cannot issue one statement and hope. Draft holding statements per brand in advance, approved by the relevant board, with a single group spokesperson accountable for consistency. Establish who may speak to customers, and require that any factual statement be drawn from one maintained timeline rather than reconstructed from memory.

The most common communication error is a group brand commenting publicly on a subsidiary it has never explained to the market. If the relationship is not already visible, an incident is a poor moment to introduce it.

Test the roll-up, not the drill

The exercise that matters is the one where the incident begins in a subsidiary and crosses an entity boundary, whether through a shared tenant, a shared payroll provider or a shared network. Build it deliberately around the weakest link: include the managing director who has never attended a tabletop, the insurer, external counsel and a communications lead for each brand.

Measure time to decision rather than time to detection. Detection metrics flatter technology teams; decision latency is what determines the cost of an incident.

What goes to the board before the next cycle

One page is enough. The severity scale, the named commander and deputy, the spend authority, the notification matrix by entity, the date and findings of the last cross-entity exercise, and two gaps with owners and dates. Boards that receive that page once a year ask better questions than boards that receive a ninety-page plan they will never read.

The test of a group playbook is not whether it reads well. It is whether, at 2am on a Sunday, the right person in the wrong entity knows exactly who to call and what they are allowed to do without asking.