In short
The Cyber Incident Manual: Preparation, Response, and Recovery is a free working document from DEN for cultural organizations. The manual helps you create a practical incident and recovery plan to prepare for cyber incidents. With concrete steps and examples, you can get started right away.
What is an incident and recovery plan?
An incident and recovery plan combines two key components of digital resilience:
An Incident Response Plan (IRP): describes how to identify, assess, and manage a cyber incident.
A Disaster Recovery Plan (DRP): describes how to restore systems, data, and processes after an incident has occurred.
DEN's manual combines these two components into one practical plan. This way, you can predefine who does what, which systems have priority, and how the organization returns to normal.
Why an incident and recovery plan?
Research by DEN shows that 3 out of 10 cultural organizations experienced a cybercrime incident between 2020 and 2023. The consequences can be significant: loss of personal data, disruption of public services, financial damage, and reputational loss. A good incident and recovery plan helps you to:
respond faster and more effectively to cyber incidents;
define responsibilities in advance;
limit damage and disruption;
establish clear communication agreements;
restore systems, data, and processes in a controlled manner.
For cultural organizations, which depend on digital collections, ticketing systems, and websites, digital resilience is not a luxury but a necessity.
What’s in the manual?
The manual guides you step by step in creating a practical incident and recovery plan for your organization. Three key components are central:
Continuity: preparing for disruption - Map out your key processes, systems, and risks, and determine recovery priorities.
Response: acting during an incident - Learn how to respond quickly and systematically, communicate, and limit damage.
Recovery: returning to normal - Develop recovery procedures and ensure systems, data, and processes are safely restored.
The manual also includes example tables, formats, and a practical roadmap to get started immediately.
Next steps in cybersecurity: choose your path
Want to learn more about cyber resilience or start working on a plan for your organization? Choose the step that suits you.
Brief introduction: free online Lunch & Learn (September 8)
Discover in 45 minutes what an incident and recovery plan is, what components it should contain, and how you can reduce the impact of cyber incidents. You will be introduced to DEN's new manual and receive practical tools to get started. There will also be room for questions.
→ Register for free (opens in new tab)
Basic knowledge: online workshop on cybersecurity in the cultural sector (October 8)
Want to lay a solid foundation first? In this online workshop, you'll learn how to enhance your organization's digital resilience. You'll gain insights into your organization's key processes, systems, and data, as well as the associated risks. You'll also learn about technical and organizational measures to prevent cyber incidents and how to integrate cybersecurity as a structural part of your organization.
→ View the workshop (opens in new tab)
Advanced: workshop on cybersecurity: create an incident and recovery plan (November 17)
Ready for the next step? During this workshop, you'll work on a first, workable draft of an incident and recovery plan for your organization. You'll gain insights into your organization's risks and critical systems, learn how to clearly organize roles, responsibilities, and communication, and receive concrete tools to further develop and secure your plan within the organization. After the workshop, you'll not only have more knowledge but also a concrete basis to move forward with.
Frequently Asked Questions
What is an incident and recovery plan?Show explanationHide explanation
An incident and recovery plan combines two key components of digital resilience: an Incident Response Plan (IRP), which describes how to identify, assess, and manage a cyber incident, and a Disaster Recovery Plan (DRP), which describes how to restore systems, data, and processes after an incident has occurred.
How detailed should an incident and recovery plan be?Show explanationHide explanation
DEN advises creating a compact and practical document that can be used immediately during an incident. The manual helps you develop a plan tailored to your organization's size, risks, and available resources.
Do I need technical knowledge?Show explanationHide explanation
No. The manual is not only intended for IT staff but also for professionals in management, operations, communication, information management, and other staff involved in the organization's continuity. Technical knowledge is not required. It is recommended to create the incident and recovery plan together with colleagues from various roles. This way, you combine the right knowledge about processes, systems, risks, communication, and decision-making, resulting in a plan that is widely supported and practically executable.
Why is this important for cultural organizations?Show explanationHide explanation
Cultural organizations often manage valuable data and digital collections. A cyber incident can not only cause financial damage but also lead to reputational damage, service disruptions, and loss of trust among visitors, partners, and funders.
How much does the manual cost?Show explanationHide explanation
The manual is free to download.
More articles per topic
New(s) on DEN
But how do you create a good image with AI? 6 tips
When should I label content as “AI-generated”?
User generated content: how to use it effectively
Lunch & Learn: prepared for cyber incidents - in 45 minutes
Does your organization know what to do in case of a phishing attack, data breach, or system outage? Join us during lunch for this free online session and get an easy introduction to creating an incident and recovery plan in just 45 minutes.
