A cyber incident response plan defines who does what, in what order, in the first hours of a confirmed cyberattack. Without one, organisations make critical decisions — who to call, what to shut down, what to tell clients — for the first time, under pressure, during the incident itself. Research in 2026 found 27% of UAE businesses had no incident response plan, while 63% had experienced at least one confirmed cyber incident in the preceding 12 months.
Almost 1 in 3 UAE businesses has no plan for when a cyberattack happens. Not if. When.Last year, more than half of UAE businesses got that call. Some panicked. Some called the wrong person. Some lost a full working day just figuring out where to start. Nobody had done this before.There is a reason every office runs a fire drill. Not because anyone thinks the building is about to catch fire. Because when it does, you do not want that morning to be the first time anyone has thought about the door.Most UAE businesses have never run a cyber drill.
A fire drill works because it separates the decision-making from the moment of crisis. When the alarm sounds, nobody has to think — they have already practised.Most UAE businesses have no cyber equivalent. The first time anyone asks who do we call is when the incident is already in progress. The decisions made in the first 30 minutes of a cyberattack often determine whether recovery takes days or months.
Write a one-page incident response plan answering: who gets called first, what gets shut down, what you tell clients
Assign named owners for each role — actual people with their personal contact numbers, not just job titles
Store the plan somewhere accessible outside your main systems — printed copy, personal email, or offline document
Run one half-day cyber drill per year using a simple scenario to find gaps before an incident does
Include non-IT leaders in the plan — finance, operations, and communications all have roles in a real incident
Disconnect affected systems from the network before attempting to diagnose anything — this limits spread and preserves evidence. Call your IT specialist before taking other technical actions. Notify your bank if financial systems are involved. Document every action from the moment of discovery. Under UAE PDPL, notification of a data breach affecting personal data is a legal obligation.
The incident response plan conversation happens one of two ways — either we run the drill before an incident and find the gaps safely, or we help build the plan after an incident has already shown what was missing. The cost of the second conversation is always higher.
