Cybersecurity for NGOs: Session 3: When Something Goes Wrong: A Simple Incident-Response Reflex

Incidents happen even in well-prepared organisations. What matters most is how calmly and quickly the NGO reacts in the first hour. This session builds a simple incident-response reflex: spotting an incident, taking the first steps, knowing who to call and communicating honestly afterwards.

It is one of three independent one-hour sessions in the “Cybersecurity for NGOs” series, delivered by Master in Cybersecurity and Cyber Defence (MCYSD) students of the University of Luxembourg, under academic supervision, in partnership with the Digital Learning Hub. Each session can be attended on its own.

The session is for staff, volunteers and board members of Luxembourg NGOs and associations. No technical background is needed.

- Spot an incident and take the five first-hour steps.

- Know who to contact, inside and outside the NGO.

- Keep a simple written incident log, with no special software needed.

- Practise on a simulated incident in small groups.

- Short recap of the most common threats, so everyone starts from the same baseline.

- Spotting an incident: a phishing click, a lost device, a ransomware message, a suspicious email from a colleague.

- The five steps to take in the first hour.

- Who to call: management and IT support, Luxembourg's national computer incident response centre (CIRCL), service providers and, where relevant, the national data protection authority (CNPD).

- A simple written incident log any NGO can start using straight away.

- Communicating honestly with donors, members and beneficiaries after an incident.

- Habits that reduce the next incident: regular checks, staff reminders, a dedicated inbox for reporting phishing.

- Group exercise: a simulated incident (a phishing email with a malicious attachment), followed by a debrief.

One-hour interactive workshop, on site at the SnT or online via Microsoft Teams: a short recap and lecture, a simulated incident worked through in small groups, a group debrief and Q&A. Participants take home a one-page incident-response plan with key contacts.