BOOK A CALL BACK
Have a question? Fill in the form below to book a call
About:
Full Name*
Business Email*
Contact Number*
Booking Date*
Menu
REMOTE SUPPORT
 NETWORK STATUS
020 7471 3277
Book a call
ALL BLOGS

How to handle a security incident: policies, roles and responsibilities

TL;DR: Most policy failures aren’t about the policy — they’re about who owns it the moment something goes wrong.

  • 43% of UK businesses reported a breach or attack last year, yet only around a quarter have a formal incident response plan.
  • Governance tends to fail at the seams: unclear ownership, no trigger for review, and evidence reconstructed after the event.
  • The questions that matter aren’t “do we have a policy?” but “who acts, who approves, and who can prove it?”
  • The right system answers those questions continuously — not in the middle of an incident.

Almost every organisation has policies. They sit in a shared drive, they get signed off once a year, and they look reassuring in an audit. The real test isn’t whether the document exists — it’s what happens at 2am when a supplier is breached, a laptop goes missing, or a member of staff downloads something they shouldn’t. In that moment, the only question that matters is a human one: who owns this, and what are they supposed to do next?

What actually happens when a policy is triggered?

A policy is only useful if it changes behaviour at the point of decision. Too often it doesn’t. Someone notices a problem, pings a colleague, and an informal scramble begins — no defined severity, no clock, no record of who decided what. The policy that was meant to govern the moment never actually enters it.

A well-run governance model flips that. When an event occurs, the policy attached to it should automatically define the severity, the owner, the deadline and the evidence that needs capturing — before anyone has to remember where the runbook lives. The difference between a controlled response and a chaotic one is rarely the quality of the writing. It’s whether the policy does anything when it’s needed.

Can your team find the policy — and actually understand it?

Part of why policies fail to govern the moment is brutally simple: nobody can find them, and when they do, they can’t make sense of them. A 40-page document buried three folders deep, last opened at the audit and written in language only its author understands, isn’t governance — it’s decoration. Under pressure, people fall back on memory and instinct rather than the policy.

The fix isn’t writing more. It’s making policy easy to reach and easy to read at the exact point a decision is made. This is where a compliance platform earns its place — one central home for every policy, in plain language, version-controlled so everyone sees the current version rather than a stale copy, and linked directly to the action it governs. A policy someone can find in seconds and understand in a sentence is one they’ll actually follow.

Who owns it — and who’s allowed to sign it off?

Ownership is where most governance quietly breaks. Ask who owns a given asset, who approves a security exception, or who is accountable for closing an incident, and you’ll often get a pause. Everyone assumes someone else has it.

This is the part regulators, boards and insurers probe hardest, because it’s where accountability lives. Clear governance means every asset, control and incident has a named owner, and every exception has a defined approver — not a verbal “yeah, that’s fine” lost in a chat thread.

And when someone wants an exception?

Exceptions are normal — businesses can’t operate on absolutes. The risk isn’t the exception itself; it’s the undocumented one. A governed approach forces an exception through a defined route: who requested it, who approved it, when it expires, and what happens if it’s never revisited. An expired exception that nobody re-reviewed is exactly the kind of gap that turns a minor finding into a serious one.

When does a policy actually get reviewed?

“Annually” is the standard answer, and it’s the wrong one. A policy reviewed on a calendar date drifts out of step with how the business actually operates the other 364 days. The events that should prompt a review — a major incident, a significant system change, a new supplier, a failed integration — almost never line up with the diary.

The stronger model is event-driven: real operational change triggers a review, so written policy and actual behaviour don’t quietly diverge. It keeps governance honest without slowing teams down, and it’s far easier to defend when someone external asks why a control looks the way it does.

Could you prove any of it tomorrow?

Here’s the test that catches people out. If the ICO, a major client or your insurer asked you to evidence how a specific incident was handled — who was notified, what was decided, when — could you produce it without a frantic week of reconstruction?

According to the UK Government’s Cyber Security Breaches Survey 2025/2026, only around a quarter of businesses have a formal incident response plan — and far fewer can show a defensible, time-stamped record of how past incidents were actually run. Audit-readiness isn’t an event you prepare for; it’s a state you’re either in or you’re not. When evidence is captured as the work happens, the audit pack is a by-product of doing the job properly — not a project in its own right.

FAQs

Q: Who is responsible for handling a security incident?
A: In a well-governed business, every incident has a single named owner accountable for the response — usually within IT or security leadership — with clearly defined roles for who investigates, who approves decisions, and who handles communications. The common mistake is assuming everyone knows their part without it being written down anywhere. Our managed cyber security team helps clients define and run that structure before it’s ever tested.

Q: How quickly do you have to report a data breach in the UK?
A: If a personal data breach is likely to put people’s rights and freedoms at risk, you must report it to the ICO without undue delay and within 72 hours of becoming aware of it. The clock starts when you discover the breach, not when it happened — and you can submit initial details and follow up as your investigation continues. Not every breach is notifiable, but you should keep a record of all of them regardless.

Q: Where should a business keep its security policies?
A: In one central, easy-to-find place that everyone can access — not scattered across shared drives, inboxes and personal folders. The most useful setups hold a single current version of each policy, written in plain language, linked to the controls and actions it governs. A compliance platform makes that practical, so the right policy is in front of the right person at the moment they need it.

Q: How often should a security policy be reviewed?
A: At least once a year, but a calendar review on its own isn’t enough. The stronger approach also triggers a review whenever something material changes — a major incident, a new supplier, or a significant system change — so the policy keeps pace with how the business actually operates rather than drifting out of date between annual sign-offs.

Q: What is a policy exception, and who approves it?
A: An exception is a documented, time-limited decision to deviate from a policy where there’s a valid business reason. It should always have a named approver, a clear expiry date, and a review before it lapses. Undocumented or long-expired exceptions that nobody revisits are one of the most common sources of both audit findings and real-world risk.

The questions to ask before the incident, not during it

If your leadership team can answer “who owns it, who approves it, when does it get reviewed, and can we prove it?” clearly and consistently, you have governance. If the answers wobble, you have documents. Pulling these threads into one governed system — where policies, roles, evidence and outcomes share the same place — is exactly the kind of resilience our managed cyber security work is built around, and it sits naturally alongside structured baselines like Cyber Essentials certification.

The first time many organisations confront these questions is mid-incident, when the answers are expensive. It’s a far better conversation to have on a quiet Tuesday.

Need IT Support? Speak to me, Sylvester
Book a call
Click to dial me
Moving to Knowall is simple Moving over to us is quick, simple and hands-free.
What actually happens when a policy is triggered