Operating Without Systems: Incident Response

The First Thirty Minutes

The call comes at 3:00 AM. Ransomware has been deployed across your infrastructure. Domain controllers are encrypted. Email is down. The VPN concentrator is offline. Your team cannot access the building management system, the phone system, or the incident response platform.

This is not a drill scenario. It is the lived experience of thousands of UK organisations every year. And the first thirty minutes determine everything that follows.

Communication Without Infrastructure

The most immediate challenge is coordination. Your team needs to communicate, but every corporate communication channel depends on infrastructure that may be compromised.

Pre-Staged Communication Channels

• Personal mobile numbers: A printed or offline-stored list of key personnel mobile numbers enables basic coordination
• Pre-configured messaging groups: Signal or WhatsApp groups created before the incident, using personal devices, provide encrypted team communication
• Out-of-band conference bridges: Pre-arranged dial-in numbers for conference calls that do not depend on corporate infrastructure

Every one of these requires prior preparation. The contact list must exist before the incident. The messaging groups must be created before the incident. The conference bridge must be arranged before the incident. Offline secure storage ensures this preparation survives the incident.

Decision-Making Without Data

Your monitoring dashboards are encrypted. Your asset inventory is inaccessible. Your network topology documentation is on SharePoint. How do you make informed containment decisions?

Pre-Staged Decision Support

• Network topology maps: Printed or offline-stored diagrams of your network architecture enable containment decisions without access to monitoring tools
• Critical services list: A prioritised list of business services and their infrastructure dependencies guides recovery sequencing
• Vendor contact matrix: Third-party support contacts, contract numbers, and escalation procedures enable external assistance

Recovery Without Credentials

Your backup console requires Active Directory authentication. Your cloud console uses SSO. Your password manager is on a server that is encrypted. How do you actually begin recovery?

Break-Glass Credential Packs

Maintain offline copies of every credential needed to begin recovery from a total compromise:

• Local administrator passwords for key servers
• Backup console local authentication credentials
• Cloud console root account credentials (not federated)
• DNS registrar account access
• Certificate authority root key material
• Firewall and switch local admin credentials

The First 24 Hours: A Practical Sequence

1. Hour 0 to 1: Establish communication, assess scope, activate incident response team using offline contact details
2. Hour 1 to 4: Contain the attack using network topology documentation. Isolate affected segments. Preserve forensic evidence
3. Hour 4 to 12: Begin recovery using offline credentials. Prioritise identity infrastructure (domain controllers), then communication (email), then business-critical applications
4. Hour 12 to 24: Initiate regulatory notification using pre-staged templates. Brief the board. Engage external support using vendor contact matrix

What This Looks Like in Practice

An organisation with offline secure storage accesses their Vault within the first hour. They retrieve the incident response pack containing contact lists, credential packs, network documentation, and notification templates. Within four hours, they have contained the attack and begun recovery. Within 24 hours, they have restored core business services and initiated regulatory notification.

An organisation without offline preparation spends the first 24 hours trying to work out who to call, what credentials they need, and how to access their backup systems. Recovery takes weeks instead of hours.

Conclusion

Operating without systems is not a theoretical exercise. It is the reality of major cyber incidents. The organisations that recover in hours are those that prepared for exactly this scenario by maintaining critical response assets in physically disconnected storage. The preparation must happen before the incident. The offline storage must be in place before the attack. There is no improvisation that compensates for prior governance.