The First-Hour Gap: Why Incident Response Isn't Resilience

Companies often disclose cyberattacks faster than they can explain the costs. This pattern reveals a gap in incident response and resilience, highlighting failures that align with specific requirements.

What Happened

With the SEC's cyber disclosure rule, public companies have four business days to file an 8-K once an incident is deemed material. This determination often occurs before the full scope is known. Filings typically state that systems are affected, operations are disrupted, and materiality is undetermined.

While security teams may detect and contain attacks, the problem lies in the aftermath. When the board inquires about impacts, next steps, financial exposure, and priorities, answers are scattered across plans, spreadsheets, and team leads. There's no unified model everyone trusts.

A PwC survey found only 6% of leaders feel "very capable" of withstanding cyberattacks. Unclear ownership of critical systems is a root cause. BDO reported that 80% of leaders say the risk environment is more crisis-driven than ever.

Timeline

This sequence is a composite, not from a single company.

1. Hour 0: An attack occurs. Security detects and begins containment.
2. Hour 1: The board asks about business impact, financial exposure, and priorities. Answers aren't centralized.
3. Days 1 to 3: Teams trace affected departments, systems, and vendors. One healthcare organization took three to five days to centralize resilience data.
4. Within four business days of a materiality determination: The 8-K is due, often with incomplete scope.
5. Week 1 and beyond: The timeline is still being pieced together.

Which Controls Failed or Were Missing

Four recurring gaps are evident:

• No agreed decision rights. Unclear ownership of critical systems delays restoration priorities.
• No current dependency view. Links between technology, suppliers, facilities, and people aren't documented in a queryable form.
• No cross-functional rehearsal. Cyber and continuity teams haven't practiced scenarios together.
• No flat prioritization. Treating everything as critical means nothing is prioritized. In one case, only 30% of processes were truly critical.

A subtler issue is placing business continuity entirely on the CISO, creating accountability without authority over supplier risk, facilities, or HR continuity.

What the Relevant Standards Require

ISO/IEC 27001:2022

• Clause 5.3 mandates assigning and communicating roles, responsibilities, and authorities. Unclear ownership of critical systems violates this.
• Clauses 4.1 and 4.2 require understanding internal and external issues and interested parties, including supplier dependencies.
• Annex A 5.29 and 5.30 demand planning for security and availability during disruptions.
• Annex A 5.24 to 5.26 cover incident management planning and response.
• Annex A 5.19 to 5.22 address supplier relationships, where cascading incidents often start.
• Clause 9.1 and Annex A 5.27 require measuring and improving based on incidents.

ISO 22301 focuses on business continuity management systems, requiring a business impact analysis and risk assessment to set priorities and recovery objectives.

ISO/IEC 27014 frames governance of information security, supporting the need for defined reporting lines.

SOC 2 covers this under Availability criteria (A1.2 and A1.3) and Common Criteria for incident response (CC7.3 through CC7.5) and risk assessment (CC3). A SOC 2 Type II examination tests whether plans are exercised, not just written.

Lessons and Action Items for Your Team

Own the impact picture, not the whole function. A CISO should focus on building a detailed view of business impact and pushing for shared visibility and defined decision rights. Running continuity for the entire enterprise can lead to accountability without control.

Do this now:

1. Assign decision rights before an incident. Document who decides restoration priority, authorizes external communication, and determines materiality. Tie each to a named role under Clause 5.3.
2. Build one dependency model. Connect business processes, applications, suppliers, facilities, and people. Start with a spreadsheet if needed, but assign an owner and refresh date.
3. Rank criticality honestly. Conduct a business impact analysis aligned to ISO 22301 and enforce a ranking. Expect only a minority of processes to be critical.
4. Exercise it with both teams present. Conduct a Scenario-Based Risk Assessment with cyber and continuity staff. Record outcomes for Annex A 5.30 and SOC 2 A1.3.
5. Test the first-hour questions. Can you answer what's impacted, what happens next, the financial exposure, and the priorities? Log gaps as Opportunities for Improvement or Nonconformities.
6. Re-review on a schedule. Suppliers and architecture change faster than plans. Set a recurring review and treat a missed one as a finding.
7. Align legal and security on disclosure. Rehearse the path from incident detection to materiality determination to the 8-K, since the four-business-day clock starts at the determination.

Avoid simply containing the attack and then spending a week reconstructing what it touched. The standards already provide the pieces. Your job is to connect them before the board asks.