Incident Response and Recovery

The first hours of a cyber incident decide most of its cost. Teams with a tested plan know who makes decisions, which regulators to notify and by when, and how to restore systems safely. SSC helps Australian and New Zealand organisations prepare for incidents, make sound decisions during one, and recover and learn afterwards.

Before an incident: readiness

• Incident response plan aligned to NIST SP 800-61 Rev. 3, published in April 2025, which organises incident response around the six functions of the NIST Cybersecurity Framework 2.0, and to ISO/IEC 27001:2022 controls 5.24 to 5.28.
• Playbooks for ransomware, business email compromise, data theft and breaches at a third party.
• Tabletop exercises for executives and technical teams, followed by a written report of the gaps found.
• Notification matrix listing every regulator, insurer, customer and partner you may need to tell, with deadlines and contacts.
• Provider readiness: confirming your cyber insurer’s panel, forensic provider and legal counsel before you need them.

During an incident: decision support

We support leadership with structured decision-making, regulator and stakeholder notifications, and coordination between your IT team, forensic investigators, lawyers and insurer, so technical responders can focus on containment.

Notification deadlines to know

• Privacy Act 1988 (Australia): assess a suspected eligible data breach within 30 days, and notify the OAIC and affected individuals as soon as practicable once it is confirmed.
• APRA CPS 234: notify APRA no later than 72 hours after becoming aware of a material information security incident.
• SOCI Act: report a cyber incident having a significant impact on a critical infrastructure asset to ASD within 12 hours, and other incidents with a relevant impact within 72 hours.
• Cyber Security Act 2024: since 30 May 2025, businesses with annual turnover above A$3 million, and SOCI-regulated entities, must report a ransomware or cyber extortion payment within 72 hours.
• Privacy Act 2020 (New Zealand): notify the Privacy Commissioner and affected people as soon as practicable after becoming aware of a notifiable privacy breach. The Commissioner expects this within 72 hours.

After an incident: recovery and lessons learned

We run the post-incident review, update risk registers and controls, prepare board reporting, and check that recovery plans worked as designed. Recovery links closely to business continuity management and, for APRA-regulated entities, to CPS 230 operational resilience.

For a plain-language walkthrough of the Australian scheme, read our notifiable data breach guide.