Incident response is the methodical process for identifying, containing, resolving, and documenting an IT incident – from the initial alert through recovery and evaluation after the incident. When an IT incident occurs – whether it is a cyber attack, data breach, or system failure – the framework for the response is what will help an organisation recover as quickly and effectively as possible. Many Flemish SMEs have multiple IT vendors – one for help desk support, another for networking, and another for backup support. This is exactly what gets in the way in an IT incident response. One integrated IT partner operating from a documented playbook shortens response time and limits damage significantly.
What is incident response and what is its importance for SMEs?
Incident response is a collection of pre-defined procedures that help an organisation respond to IT incidents such as data breaches, ransomware attacks, or system failures in an orderly and legal manner.
For SMEs in Flanders, this is not a theoretical concern. Both the GDPR and the NIS2 directive, transposed into Belgian legislation and in force since October 2024, impose an obligation to report incidents within specific time periods. Additionally, documentation must be kept internally. Article 33 of the GDPR indicates that a data breach must be notified to the relevant authority within 72 hours after becoming aware of the incident. Organizations that do not have an incident response plan in place face not only reputational damage but also legal consequences.
Why is vendor fragmentation a problem in incident response?
Vendor fragmentation is the term used to define the situation in which the organisation is dependent on multiple separate vendors for its IT infrastructure, though the vendors are neither mutually aligned nor hold joint accountability.
What are the issues that may be faced while dealing with multiple vendors?
In case of an incident in the fragmented vendor situation, the following situation arises:
- No central accountability: Each vendor manages its own domain. No single party has the complete picture.
- Delayed detection: Logs and alerts are distributed across systems that do not communicate with each other.
- Unclear escalation paths: Who do you call first – the network provider, the backup vendor, or the software supplier?
- Conflicting advice: Vendors protect their own systems, which delays joint decision-making.
- GDPR risk: The 72-hour reporting window starts the moment you become aware of a breach, not when all vendors have agreed on the cause.
Concrete example: A ransomware attack hits a file server. The backup vendor confirms their system worked correctly. The network vendor points to endpoint security. The endpoint vendor redirects to the firewall partner. Meanwhile, the clock is running.
How does incident response work with one integrated IT partner?
An integrated IT partner is a provider that manages an organisation’s complete IT environment: from hardware and networking to security, backup, and compliance, under a single SLA and a single point of contact.
With one partner, incident response follows a connected six-phase process:
Phase 1 – Preparation: what is arranged in advance?
Preparation is the foundation of any incident response plan. Without it, response is reactive and disorganised.
Preparation includes:
- Staff awareness training: Employees understand how to respond to a suspected data breach, which steps to follow, and who to contact.
- GDPR-aligned governance: Documented responsibilities, data flows, and processing procedures are established before an incident occurs.
- Centralised monitoring: Centralised logging and alerting detects anomalies proactively.
- Regular patch cycles: Known vulnerabilities on servers and workstations are systematically addressed before they can be exploited.
- Backup and disaster recovery: Data recovery procedures are tested and documented.
Phase 2 – Detection: how is an incident identified?
Detection is the process by which abnormal behaviour in an IT environment is identified and categorised as a potential incident.
- Centralised alerting continuously monitors logs and security events.
- Host and network monitoring identify indicators of compromise (IoC) on servers, endpoints, and in network traffic.
- Failed or incomplete server updates automatically generate incident tickets, triggering investigation.
Phase 3 – Containment: how is further damage prevented?
Containment is the set of technical and administrative measures that limit the spread of an incident while investigation is ongoing.
- Technical containment: Affected systems are isolated. Firewall layers, antivirus filters, and phishing/malware filters reduce further exposure.
- Administrative containment: Access to affected systems and data is restricted. GDPR documentation of the incident begins immediately.
Phase 4 – Eradication: how is the root cause removed?
Eradication is the process by which the root cause of an incident is identified and structurally eliminated.
- Incident tickets are analysed to determine why a breach, failure, or anomaly occurred.
- Malware and malicious data are removed.
- Exploited vulnerabilities are patched and unauthorised access is blocked.
Phase 5 – Recovery: how is a safe return to operations achieved?
Recovery is the controlled restoration process by which systems return to a reliable operational state following validation.
- Systems are restored from clean backup data.
- Restored systems are validated to confirm no remaining indicators of compromise.
- Systems are brought back online gradually while monitoring remains active.
Phase 6 – Reporting and notification: what are the legal obligations?
Reporting and notification are the obligatory processes after the data breach.
- The data protection authority, in this case the Data Protection Authority (GBA / APD) in Belgium, needs to be notified within 72 hours after the data controller became aware of the data breach.
- At least the following needs to be included in the data breach notification: the categories and number of individuals affected, as well as the categories and number of data records affected.
- The data subjects need to be notified without undue delay in case the data breach poses a high risk to the rights and freedoms of the data subject, as per GDPR Article 34.
- All data breaches, including the details, the impact, and the measures taken, are documented in the organization.
What should happen after an incident?
Post-incident evaluation is the structured review process by which the effectiveness of detection, response, and recovery is assessed and processes are adjusted accordingly.
After every incident, a structured evaluation covers:
- Review of detection systems: How did monitoring tools perform? What gaps became visible?
- Process improvement: Internal procedures, risk management documentation, and change management workflows are updated.
- Preventive reinforcement: Based on lessons learned, firewall rules, patching practices, staff awareness training, or backup strategies are strengthened.
Comparison: multiple vendors versus one integrated IT partner
| Criterion | Multiple Vendors | One Integrated Partner |
| Point of contact during incident | Unclear, multiple parties involved | Single contact, single SLA |
| Response time | Delayed by coordination overhead | Immediate, no handover loss |
| GDPR 72-hour deadline | At risk due to slow escalation | Documented process, on time |
| Visibility of full environment | Fragmented | Centralised and complete |
| Containment | Dependent on inter-vendor cooperation | Coordinated from one team |
| Post-incident evaluation | Difficult due to distributed accountability | Integrated into one review |
| Cost during incident | High: time, coordination, damage | Lower through faster response |
FAQ
What is incident response?
Incident response is the structured process by which an organisation detects, contains, resolves, and documents an IT incident such as a data breach, cyberattack, or system failure.
Within what timeframe must a data breach be reported under GDPR?
Under GDPR Article 33, a data breach must be reported to the competent supervisory authority within 72 hours of becoming aware of it. In Belgium, that authority is the Data Protection Authority (GBA / APD).
Why is vendor fragmentation a risk in incident response?
With multiple vendors, there is no central accountability. Coordination takes time, and that time works in favour of the attacker or amplifies operational damage.
What is the difference between containment and eradication?
Containment stops the further spread of an incident while investigation is ongoing. Eradication removes the root cause structurally and permanently.
Is incident response only relevant for cyberattacks?
No. Incident response also applies to hardware failure, human error, loss of a device, or unintended data exposure – any event that threatens the availability, integrity, or confidentiality of data.
What does ITAF do after an incident to prevent recurrence?
After every incident, ITAF conducts a post-incident evaluation. Based on the findings, procedures are updated, vulnerabilities are structurally resolved, and preventive measures are reinforced including patch policy, firewall rules, or staff awareness training.
