None of this needs new tooling or a budget cycle. It needs decisions made before the call comes, and evidence that the decisions hold.
1. Know your recovery time. Prove it.
Pick the system you cannot run without, ask who would actually be awake to restore it, and time the whole thing end to end.
2. A backup you have never restored is a file, not a control.
It is usually the one system nobody monitors, and the one you find out about at the worst possible moment.
3. The clock starts before you know what happened.
Notification deadlines run from awareness, not from the day your investigation finishes. Under NIS2 an early warning is due within 24 hours; under GDPR, notification to the supervisory authority within 72 hours.
4. Decide who decides, before the call comes.
Payment, notification, law enforcement, taking systems offline. Every decision left unmade on the day is a delay.
5. The first hour is forensic.
What is done in the first hour decides whether you end up with evidence that holds, or only an account of events.
Thirty days is enough. One tabletop, one restore test, one decision matrix. That is the whole programme, and it is the difference between a bad week and a bad year.
If you want to rehearse it properly, the Incident-Readiness Tabletop runs the scenario with your leadership and IT, and leaves you with the decision matrix and an after-action report.