Cyber Incident Manual: Preparation, Response, and Recovery

What is an incident and recovery plan? 

An incident and recovery plan combines two key components of digital resilience: 

• An Incident Response Plan (IRP): describes how to identify, assess, and manage a cyber incident.  

• A Disaster Recovery Plan (DRP): describes how to restore systems, data, and processes after an incident has occurred.  

DEN's manual combines these two components into one practical plan. It establishes in advance who does what, which systems have priority, and how the organization returns to normal. 

Why an incident and recovery plan? 

Research by DEN shows that 3 out of 10 cultural organizations experienced a cybercrime incident between 2020 and 2023. The consequences can be significant: loss of personal data, disruption of public services, financial damage, and reputational loss. A good incident and recovery plan helps you: 

• respond to cyber incidents faster and more effectively; 

• define responsibilities in advance; 

• limit damage and downtime; 

• make clear agreements about communication; 

• restore systems, data, and processes in a controlled manner. 

For cultural organizations, which rely on digital collections, ticketing systems, and websites, digital resilience is not a luxury but a necessity. 

What does the manual include? 

The manual guides you step by step in creating a practical incident and recovery plan for your organization. It focuses on three key components: 

• Continuity: prepare for disruption - Map out your key processes, systems, and risks, and determine recovery priorities. 

• Response: take action during an incident - Learn how to respond quickly and systematically, communicate effectively, and minimize damage. 

• Recovery: return to normal - Develop recovery procedures and ensure systems, data, and processes are safely restored. 

The manual also includes example tables, formats, and a practical roadmap to get started right away.