The most important question during an IT emergency is often: How long does the IT have to remain "off"? This is understandable, as today many parts of the value chain depend on functioning IT. Preparation for an IT emergency should therefore aim to keep downtime as short as possible.

The first steps are often crucial: The correct decision whether to disconnect a computer from the network or turn it off, for instance, can have significant consequences for the duration of investigation and repair. It is therefore important to involve experts as quickly as possible. To achieve this, it is helpful to train "digital first responders," similar to medical first responders. A "emergency card" for the initial correct steps at each IT workplace can also be very useful.

If backups are unavailable, it may take several weeks before systems can be restored to a functional state. Consequently, it is very beneficial to regularly secure important systems and test the restoration process to be prepared for emergencies. For cloud applications, the cloud service provider takes care of this – one more reason to switch to cloud-based solutions.

After a hacker attack, communication via standard communication tools (email, landline, company chat) is often impossible, as these systems need to be cleaned first. An alternative communication option, such as mobile phones and SMS (while storing the contact details of customers and partners), can save a significant amount of time.