Category E · Execution · Scenario 10
Operational or Cyber Incident
Something has stopped the business working normally — a system outage, a cyber attack, fraud or a major operational failure. The immediate priorities are safety, containment and keeping essential functions such as payroll, billing and supplier payments running. Specialist help is often essential.
Trigger
A major outage, fraud incident or cybersecurity event interrupts important operations.
First move
Activate your incident response process, protect systems, escalate responsibly and identify cash and operational exposure.
Immediate first response
Follow your incident response plan, contain the problem and engage qualified specialists — then confirm you can still pay staff and suppliers.
First 24 hours
- Activate your incident response plan and assign a single incident lead
- If cyber-related, isolate affected systems and engage qualified cyber professionals
- Contact your bank immediately if fraudulent payments are suspected
- Notify your insurer
- Consider reporting to CERT NZ / NCSC and, where personal information is affected, the Privacy Commissioner
Next 7 days
- Confirm payroll, billing and supplier payment processes can operate
- Communicate clearly with staff, customers and suppliers
- Estimate the financial impact — lost sales, recovery costs, delayed receipts
- Document everything for insurance and any regulatory obligations
Next 30 days
- Complete a review of what happened and why
- Strengthen controls — multi-factor authentication, payment verification, backups
- Test backups and recovery processes
- Update the incident response and continuity plans
Typical causes
- Ransomware, phishing or email compromise
- Payment fraud, including fake bank account change requests
- System or software failure
- Fire, flood or loss of premises
- Loss of key staff or knowledge
Early warning signs
- Unusual system behaviour or login alerts
- Requests to change supplier bank account details
- Unexplained payments or missing funds
- Repeated small outages
Trigger indicators
- Any confirmed or suspected cyber compromise
- Critical system unavailable for more than an agreed time
- Any unexplained payment or suspected fraud
Financial implications
- Lost revenue and delayed billing reduce cash receipts
- Recovery, specialist and legal costs can be significant
- Fraud losses may not be recoverable
- Insurance may cover some costs — check terms and notification deadlines
Questions management should ask
- Is the incident contained?
- Can we pay staff and critical suppliers this week?
- Can we still invoice and collect from customers?
- What are our legal and privacy notification obligations?
- What does our insurance cover, and have we notified them?
- What controls failed, and how do we fix them?
Common mistakes
- Trying to handle a serious cyber incident without specialists
- Paying a ransom without professional and legal advice
- Changing supplier bank details without phone verification
- Forgetting about cash while focused on the technical problem