SUVAT
Published 28 April 2025 Advisory guidance Ref: SUVAT/GD/2025/005

Suggested cyber incident response framework for organisations

Advisory guidance on how organisations can structure their response to significant cyber incidents, including suggested severity classifications, escalation pathways, roles and responsibilities, and communications best practice. This is advisory guidance only and does not represent an official protocol.

Advisory guidance. This document provides suggested best practice for organisations developing or reviewing their incident response capabilities. It is based on publicly available frameworks and SUVAT's independent research. It does not constitute an official government protocol and SUVAT does not have authority to direct any organisation's response to a cyber incident.

1. Purpose and scope

This framework provides advisory guidance for organisations seeking to establish or improve their cyber incident response capabilities. It suggests a structured approach to incident classification, escalation, roles and responsibilities, communications and post-incident review.

This guidance is relevant to organisations of all sizes. It references publicly available frameworks from the National Cyber Security Centre (NCSC) and industry best practice.

2. Suggested severity classification

SUVAT recommends organisations classify cyber incidents using a tiered severity model. The following is a suggested framework:

  1. The incident affects, or has the realistic potential to affect, essential services across multiple parts of the organisation simultaneously.
  2. The incident has caused, or is likely to cause, significant disruption to critical business functions.
  3. The incident involves a sophisticated or persistent threat actor.
  4. The incident has resulted in, or is likely to result in, the compromise of sensitive data.
  5. The incident requires senior leadership decision-making due to its business impact or public profile.
  6. The incident has attracted, or is likely to attract, significant media and public attention.

3. Suggested roles and responsibilities

3.1 Internal incident response team

Organisations should designate an internal incident response team with clear responsibilities, including:

  • Providing technical analysis of the attack vectors, malware families and threat actor infrastructure involved in the incident.
  • Disseminating indicators of compromise (IOCs), detection signatures and mitigation guidance to affected teams.
  • Operating a central point for incident reporting, information sharing and situational awareness.
  • Producing regular situation reports for senior leadership.

3.2 External resources

Organisations may wish to reference the following external resources during an incident:

  • National Cyber Security Centre (NCSC) — publishes technical advisories, alerts and incident management guidance.
  • Action Fraud — the UK's national reporting centre for fraud and cybercrime.
  • Information Commissioner's Office (ICO) — for incidents involving personal data breaches reportable under UK GDPR.
  • Your local police force — if a crime is in progress or has been committed.

3.3 Communications best practice

  • Designate a single point of contact for incident communications to avoid conflicting or duplicated information.
  • Prepare holding statements and reactive media lines in advance of any public disclosure.
  • Coordinate internal and external communications through a single team.
  • Consider legal and regulatory notification obligations (e.g. ICO, sector regulators).

4. Escalation pathway

4.1 Suggested escalation levels

The following is a suggested escalation pathway for cyber incidents:

Level Governance Trigger
Level 1 — Team IT security team / SOC Incident detected within a single team or system, manageable with existing resources.
Level 2 — Cross-organisation CISO or incident response lead Incident affects or may affect multiple teams or systems.
Level 3 — Senior leadership CEO, board or equivalent Incident is escalating, senior decision-making is required, or external notification may be necessary.
Level 4 — External External partners, regulators, law enforcement Incident requires external notification, support or investigation.

5. Post-incident review

Following a significant incident, SUVAT recommends conducting a formal post-incident review within 60 days. The review should cover:

  • Effectiveness of detection, reporting and escalation processes.
  • Effectiveness of containment and recovery actions.
  • Accuracy and timeliness of communications (internal and external).
  • Lessons identified and recommendations for improving the organisation's incident response plan.
Disclaimer. This guidance is advisory only. SUVAT does not conduct criminal investigations and does not provide emergency response services. In case of an active crime, contact your local police force. This guidance is reviewed periodically by SUVAT. Feedback is welcome at research@suvat.uk.