The alarm goes off at 2 a.m.: ransomware has locked down a hospital trust's systems, or a government department's data has just leaked. What happens in the next hour — not the next week — usually decides how bad the story gets.

The UK, as a global hub for finance, technology and infrastructure, faces exactly this scenario more often than most. Effective crisis management has become as essential to national defence as the technical controls that try to prevent the attack in the first place.

Arab British Fellowship Training Academy's "Leading the Response to Cyber Crises" course equips professionals with the knowledge and judgement to manage a cybersecurity crisis end to end: detection, coordination, recovery, and the leadership decisions that hold an organisation together while it happens.

Who Should Attend?

• Incident Response Teams and Cybersecurity Analysts handling live cyberattacks.
• Crisis Management and Business Continuity Professionals coordinating organisational response.
• IT Professionals and Engineers securing systems and infrastructure under pressure.
• Government Officials working in national cybersecurity roles, including the National Cyber Security Centre (NCSC).
• Cybersecurity Managers building or testing their organisation's crisis response capability.

Knowledge and Benefits:

• Apply the core concepts and frameworks behind UK cyber crisis management.
• Build and run incident response strategies that limit the damage of a live crisis.
• Coordinate across teams and organisations to keep the response fast and unified.
• Apply UK standards and best practice to managing cyber emergencies.
• Strengthen organisational resilience through recovery plans and crisis communication.

Module 1: The First Hour of a Cyber Crisis

• Spotting the early signs of an attack and containing it fast.
• Making high-pressure decisions: what to prioritise when everything feels urgent.

Module 2: What Counts as a Cyber Crisis

• Ransomware, data breaches, DDoS attacks and other incidents that escalate into a crisis.
• Judging severity and the operational impact of each type.

Module 3: The UK Cybersecurity Landscape and Legal Duties

• The National Cyber Security Centre's (NCSC) role and how UK organisations prepare for crises.
• Key obligations under the Data Protection Act 2018 and GDPR.

Module 4: Assessing Risk Before the Crisis Hits

• Running cybersecurity risk assessments on critical assets.
• Proactive measures and staff training that reduce the odds of a crisis in the first place.

Module 5: Building a Crisis Management Plan

• Core components of an effective plan and where responsibility sits.
• Testing the plan through simulation rather than waiting for the real thing.

Module 6: Coordinating the Response

• Getting IT, legal, PR and leadership working from the same information.
• Working with the NCSC, the National Crime Agency and other external agencies.

Module 7: Recovery and Business Continuity

• Backups, redundancy and failover systems that keep operations running.
• Protecting critical services while systems are being restored.

Module 8: After the Dust Settles: Damage Control

• Root-cause analysis and capturing the lessons learned.
• Rebuilding trust with customers, partners and the public.

Module 9: Legal and Ethical Lines During a Crisis

• Balancing transparency with operational security.
• Protecting the privacy and rights of people affected by the incident.

Module 10: Strengthening Resilience for Next Time

• Continuous monitoring and improvement once the crisis is over.
• Building a culture of cybersecurity awareness across the organisation.

Module 11: Leading Through the Crisis

• The leadership decisions that determine how well a crisis is handled.
• Keeping a unified, coordinated response across every level of the organisation.

Module 12: What's Coming Next

• How AI and increasingly sophisticated attacks are changing crisis management.
• Preparing today's plans for tomorrow's threats.