FREE TOOL
What should you do in the first hours of a cyber attack?
Play through four real decision points, from the moment you find out to the one-month NIS2 final report, and see the consequence of each choice. Each stage is a real Belgian deadline, not a guess: the 24-hour early warning, the 72-hour incident notification, the one-month report.
Minute zero
Your screen locks and a ransom note appears. This is the moment the clock starts, not when the attack actually began.
Why does the first hour matter so much?
The Belgian NIS2 law (art. 35) [1] starts the clock when you find out about a significant incident, not when the attack began or when you fully understand it. An attacker can sit in a network for weeks before anyone notices. Once you notice, three deadlines run at once. The first, the 24-hour early warning, falls due before most companies have finished confirming what happened.
That is the point of this scenario. The right move at each stage is rarely to wait until you are sure. A short, incomplete early warning sent on time beats a complete one sent late. If personal data may be involved, the GDPR (art. 33) [2] adds a separate 72-hour report to the Data Protection Authority, on top of the NIS2 steps.
Check the exact deadlines for your own timestamp with the incident reporting clock.
What are the 5 things to prepare now, before Monday happens?
- A written incident plan that says who calls whom and in what order, agreed before anything happens.
- Backups ransomware cannot reach: offline or immutable, with a restore you have tested.
- The CCB’s notification platform and emergency number saved offline, in case the server holding them is the one that gets encrypted.
- A named owner for the ransom decision, with legal and insurance advice lined up in advance.
- The PANIC sheet printed and next to the screen, in case your browser will not open.
Work out what a day of this would actually cost your business with the ransomware downtime cost calculator.
See also the guide on incident response basics.
No written plan yet? Download the free Incident Response Plan template, with the NIS2 reporting deadlines already filled in.
Frequently asked questions
- Is this based on a real Belgian case?
- The scenario is a composite, not one specific company’s story. The deadlines and the order of the three NIS2 reporting steps are real and come from the Belgian NIS2 law, art. 35 [1].
- Does the 24-hour clock really start before we know what happened?
- Yes. It starts from when you become aware of the significant incident, not from when you understand it fully. That is why the early warning is short on purpose.
- Should we ever pay the ransom?
- This tool doesn’t make that call for you: it’s a decision with legal, financial and ethical weight that needs qualified advice, made in advance rather than during the incident. What it does say is that paying or not paying doesn’t change the NIS2 and GDPR reporting deadlines.
- What if we are not sure NIS2 applies to us?
- The reporting deadlines in this scenario apply to essential and important entities under the Belgian NIS2 law. Any organisation handling personal data still has the separate 72-hour GDPR breach report regardless.
- We don’t have an incident plan yet. Where do we start?
- Start with the 5 things listed on this page, and the incident response basics guide. A one-page plan with names and a call order beats no plan, even an unfinished one.
Related free tools
- Incident reporting clock Enter when you found out about a cyber incident. Get every Belgian NIS2 reporting deadline to the CCB, plus the GDPR 72-hour deadline, to the minute.
- Ransomware downtime cost calculator Enter your staff count, hourly cost and days down. See what a ransomware attack would cost your company, per day and in total, with the formula shown.
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/after-the-attack/, by Easy Cyber Protection.