Cyber Incident Guide: Preparation, Response, and Recovery

What is an incident and recovery plan? 

An incident and recovery plan combines two important components of digital resilience: 

• An Incident Response Plan (IRP): describes how you identify, assess, and manage a cyber incident.  

• A Disaster Recovery Plan (DRP): describes how you restore systems, data, and processes after an incident has occurred.  

DEN's guide combines these two components into one practical plan. This way, you can predefine who does what, which systems have priority, and how the organization returns to normal operations. 

Why an incident and recovery plan? 

Research by DEN shows that 3 out of 10 cultural organizations experienced a cybercrime incident between 2020 and 2023. The consequences can be significant: loss of personal data, disruption of public services, financial damage, and reputational loss. A good incident and recovery plan helps you: 

• respond to cyber incidents faster and more effectively; 

• predefine responsibilities; 

• limit damage and downtime; 

• make clear agreements about communication; 

• restore systems, data, and processes in a controlled manner. 

For cultural organizations, which depend on digital collections, ticketing systems, and websites, digital resilience is not a luxury but a necessity. 

What is included in the guide? 

The guide helps you step by step to create a practical incident and recovery plan for your organization. It focuses on three key components: 

• Continuity: being prepared for disruption - Map out your critical processes, systems, and risks, and determine recovery priorities. 

• Response: acting during an incident - Learn how to respond quickly and systematically, communicate effectively, and minimize damage. 

• Recovery: returning to normal - Develop recovery procedures and ensure systems, data, and processes are safely restored. 

The guide also includes sample tables, templates, and a practical roadmap to get started right away. 

Further with cybersecurity: choose your next step 

Do you want to learn more about cyber resilience or start working on a plan for your organization? Choose the step that suits you. 

Short introduction: free online Lunch & Learn (September 8) 

Discover in 45 minutes what an incident and recovery plan is, what components it should include, and how it can help you mitigate the impact of cyber incidents. You'll be introduced to DEN's new guide and receive practical tools to get started. There will also be time for questions.  

→ Register for free 

Basic knowledge: online workshop on cybersecurity in the cultural sector (October 6) 

Would you like to lay a solid foundation first? In this online workshop, you'll learn how to enhance your organization's digital resilience. You'll gain insight into your organization's key processes, systems, and data, as well as the associated risks. Additionally, you'll learn about technical and organizational measures to prevent cyber incidents and how to integrate cybersecurity structurally into your organization. 

→ View the workshop (opens in new tab)

In-depth: workshop on cybersecurity: create an incident and recovery plan (November 17)  

Ready for the next step? During this workshop, you'll work on a first, workable draft of an incident and recovery plan for your organization. You'll gain insight into your organization's risks and critical systems, learn how to organize roles, responsibilities, and communication clearly, and receive concrete tools to further develop and anchor your plan within the organization. After the workshop, you'll not only have more knowledge but also a concrete foundation to continue working with. 

→ View the workshop (opens in new tab)