Here's the uncomfortable truth about cyber incident response in New Zealand: most businesses don't think about who they'd call until they need to call someone.
Datacom's 2026 Cybersecurity Index - based on an Omdia survey of more than 700 senior business and IT leaders - found that less than 30% of New Zealand organisations have a formal business continuity or cyber incident response plan in place. Meanwhile, three-quarters of those same leaders said they had sufficient visibility of risks and the internal resources to deal with a cyber attack.
That gap - between confidence and actual preparedness - is where incident response fails. Leaders believe they're covered. The plan either doesn't exist, hasn't been tested, or names a provider who has never been briefed on the environment. When an incident occurs, the response starts from scratch at exactly the moment speed matters most.
"Detection reduces surprise. It doesn't reduce disruption. And disruption is what costs you customers, revenue, and trust."
Choosing an incident response provider before you need one is one of the most direct investments an NZ SME can make in its resilience. The ten criteria below are what the vetting conversation should actually cover - not marketing language and generic service descriptions, but the specific questions that reveal whether a provider can genuinely help your business recover when something goes wrong.
Every incident response provider will tell you they have a process. The question is whether they can describe it specifically, step by step, in the context of your environment - and whether that description matches what they actually do.
A genuine incident response process for an NZ SME should cover: how the initial alert or notification is received, how severity is assessed, what the first containment actions are and who takes them, how forensic evidence is preserved (because destroying it during recovery is one of the most common and expensive mistakes), how communication is managed internally and externally, how the Privacy Act notification obligation is handled, and what the recovery and post-incident review process looks like.
If a provider gives you a generic description of incident response phases without being able to speak to how those phases work in a Microsoft 365 environment, for a business your size, with the specific systems you run - that's a gap worth noting.
Ask: Walk me through exactly what happens in the first two hours after we call you about a suspected ransomware incident. Who does what, in what order?
Response time is the most marketed and least standardised metric in incident response. A provider who says they respond within one hour may mean one of three very different things: someone acknowledges your call within an hour, an analyst begins reviewing your environment within an hour, or active containment begins within an hour.
For an NZ SME experiencing a live incident, only the third definition is operationally meaningful. Acknowledgement without action doesn't stop an attacker. Investigation without containment doesn't protect your data.
The time-of-day dimension matters too. Most ransomware deployments happen outside business hours - specifically because attacker groups know that detection and response capability is reduced on evenings and weekends. A provider whose NZ-based response capability operates 9am–5pm Monday to Friday has a coverage gap during the hours when incidents are most likely to escalate.
Ask: What's your SLA definition of "response" - acknowledgement, investigation, or containment? Where are the analysts who would respond to our incident located, and what hours does that response capability cover?
Enterprise incident response and SME incident response are different disciplines. Enterprise providers work in environments with dedicated security teams, documented asset inventories, and established communication trees. An NZ SME in a crisis typically has none of those things - the business owner is managing staff anxiety, client communication, and technical recovery simultaneously, without internal security expertise to lean on.
A provider who understands the SME context knows how to lead the response rather than assuming internal capability that doesn't exist. They know how to communicate with non-technical business owners under stress, how to manage the insurance notification process, and how to make the decisions that need to be made quickly without requiring the business to fully understand the technical detail.
Reference cases from NZ SME incidents - not enterprise case studies or government agency engagements - are the most direct evidence of this capability.
Ask: Can you describe a recent incident you managed for an NZ SME of similar size to ours? What was the nature of the incident, how long did recovery take, and what was the outcome?
For most NZ SMEs, a cyber incident is a Microsoft 365 incident. Business email compromise. Compromised Entra ID credentials. Ransomware that entered through a phishing email and spread through SharePoint. The attack surface for most NZ SMEs is primarily Microsoft - and incident response that doesn't have specific Microsoft 365 expertise is operating without full visibility into where the attack started, how far it spread, and what was accessed.
Microsoft 365 incident response requires specific technical knowledge: how to read Entra ID audit logs, how to identify and remove attacker persistence mechanisms, how to review and remediate email forwarding rules, how to assess what data was accessed through compromised accounts, and how to harden the environment after recovery to reduce the likelihood of re-entry.
As we covered in our post on Microsoft Entra ID, Entra ID is where identity-based attacks leave their traces - and where recovery and hardening needs to happen. A provider without specific Entra ID expertise will miss things that matter.
Ask: Do you have Microsoft-certified security professionals on your incident response team? Have you managed incidents specifically involving Microsoft 365 and Entra ID compromise? What does your M365 forensic capability look like?
This is the criterion most NZ SMEs don't think to ask about - and one of the most consequential gaps in incident response capability for NZ businesses specifically.
"The Privacy Act 2020 requires notification within 72 hours of becoming aware of a notifiable privacy breach. That clock starts when you first suspect something is wrong - not when the investigation is complete. The notification process is happening simultaneously with technical recovery, under significant time pressure, with legal and reputational stakes that compound if handled poorly.
A provider who has navigated NZ Privacy Act notification obligations before - who knows what constitutes a notifiable breach, what the notification needs to contain, how to communicate with the Privacy Commissioner, and how to draft the client notifications that need to go out - is materially different from one who manages the technical recovery and leaves the regulatory response to you.
This is particularly relevant for businesses in professional services, healthcare, legal, and financial services - sectors where the sensitivity of client information and the depth of regulatory obligation are highest.
Ask: Have you managed Privacy Act notification obligations in NZ incidents before? Who in your team handles that? Do you work alongside our legal counsel during the notification process, or do you hand off?
Cyber insurance is only as useful as the claim process - and the claim process is significantly smoother when your incident response provider has an established working relationship with NZ cyber insurers and understands what they need.
Common claim complications arise from: incidents not being reported to the insurer within the policy's notification window (typically 48–72 hours), forensic evidence being destroyed during recovery before the insurer's investigators can access it, and recovery proceeding in ways that don't meet the documentation standards the insurer requires for reimbursement.
A provider who has worked alongside NZ cyber insurers during live incidents knows what documentation to preserve, how to communicate with the insurer's claims team, what the insurer's forensic requirements are, and how to structure the recovery in a way that supports the claim rather than complicating it.
As we covered in our post on what a cyber insurance claim actually costs NZ businesses, the most common reasons claims fail are late notification and inadequate documentation - both of which a good incident response provider helps you avoid.
Ask: Have you worked directly with NZ cyber insurers during incident response? Which insurers? What does your process for supporting a cyber insurance claim look like?
The best incident response engagement doesn't start when something goes wrong. It starts before - with a provider who has already been briefed on your environment, understands your systems and data, knows who the key contacts are, and has helped you document the response plan that will be executed when needed.
"A plan that's never been tested isn't a plan - it's a document. Resilience is built through realistic practice that creates muscle memory, so response becomes automatic, coordinated, and fast.
Pre-incident engagement typically includes: an environment briefing so the provider understands your systems before a crisis, incident response plan documentation, a tabletop exercise that runs your team through a simulated incident and identifies the gaps in the plan, and clear escalation contacts and communication protocols that don't need to be established in the middle of an incident.
A provider who only engages when an incident is underway is starting from zero every time. A provider who's already familiar with your environment can move faster, make better decisions, and avoid the time-consuming discovery phase that extends recovery.
Ask: Do you offer pre-incident retainer arrangements? What does your onboarding process look like before an incident occurs? Do you offer tabletop exercises as part of your engagement?
Forensic evidence is what tells you what happened, how far the attacker got, and what they accessed. It's also what your insurer, your lawyers, and potentially law enforcement will need if the incident results in legal or regulatory consequences.
Destroying forensic evidence during recovery - wiping infected devices, restoring from backup without preserving a forensic image, rebuilding systems before logs have been collected - is one of the most common and most costly mistakes in incident response. It's understandable: when systems are down, the instinct is to restore them as fast as possible. But the recovery has to be structured in a way that preserves the evidence alongside restoring the operations.
<cite index="36-1"Datacom notes that after an incident, getting back on track requires both technical recovery and clear documentation of what occurred - both for your own understanding and for insurers and regulators. A provider who doesn't have a clear forensic evidence preservation protocol built into their response process is prioritising speed of recovery over quality of evidence - and that trade-off can cost you significantly more in the long run.
Ask: How do you preserve forensic evidence during incident response? What's your process for maintaining a forensic image before systems are restored? Do you have certified digital forensics professionals on your team?
Datacom's 2026 research found that most NZ leaders expect to recover from a major cyber incident in a matter of days - while real-world examples show recovery often takes weeks or months. The gap between expectation and reality is where businesses get into trouble - underplanning for the duration, under-resourcing the recovery, and making commitments to clients and partners that the recovery timeline can't meet.
A trustworthy incident response provider will be honest about what recovery actually takes for incidents of different types and scales. Ransomware recovery without clean backups is a different proposition from ransomware recovery with tested, isolated backups. Business email compromise with months of dwell time is more complex to remediate than one caught early. Data exfiltration with Privacy Act notification obligations has a regulatory timeline that sits alongside the technical recovery.
A provider who gives you a confident, fast recovery estimate before understanding your environment and the nature of the incident is telling you what you want to hear, not what you need to know. That kind of optimism is expensive when the timeline doesn't hold.
Ask: What does recovery typically look like for an incident of X type, for a business of our size, with our kind of environment? What are the factors that extend recovery significantly? What's the longest recovery you've managed and why did it take that long?
This criterion matters more than most buyers expect. NZ incident response has specific dimensions - the Privacy Act 2020, NCSC engagement, NZ legal counsel, NZ cyber insurance relationships, NZ court and regulatory processes - that global or Australian-focused providers may handle less well than those operating primarily in the NZ market.
Response time also has a geography dimension. A provider with analysts based primarily offshore may be responsive during business hours but significantly slower when incidents escalate overnight or on weekends. For an NZ SME experiencing a live ransomware incident on a Saturday evening - which is exactly when those incidents tend to be deployed - the difference between NZ-based on-call coverage and offshore coverage is measured in hours of additional damage.
Data sovereignty is a related consideration. 51% of NZ organisations say they are concerned about where their data is held and processed during a cyber incident, with 48% saying those concerns are affecting their cybersecurity practices. For an incident involving sensitive client data, who handles the forensic evidence - and where - matters both for data governance and for the integrity of any legal proceedings that follow.
Ask: Where are your incident response team members based? What does your NZ-based coverage look like outside business hours? Who in your team has direct relationships with the NCSC and NZ cyber insurers?
An NZ SME that works through all ten of these criteria will quickly separate providers who are genuinely prepared for the NZ SME context from those who are adapting enterprise or offshore capability. The strongest incident response providers for NZ SMEs share a consistent profile:
Pre-incident engagement that means the provider knows your environment before something goes wrong - not starting from scratch at 11pm on a Saturday.
Specific Microsoft 365 and Entra ID capability that reflects where most NZ SME incidents actually originate and propagate.
NZ Privacy Act experience that covers the regulatory obligations that run alongside technical recovery.
NZ cyber insurer relationships that support the claim process rather than complicating it.
Honest recovery timelines that reflect what incidents of your type actually take - not what you want to hear.
NZ-based response coverage that works when incidents happen, not just during business hours.
NSP's incident response capability is built for exactly this context - NZ SMEs running Microsoft 365, navigating NZ regulatory obligations, working with NZ cyber insurers, and needing a partner who already knows their environment when something goes wrong.
The best time to have this conversation is before you need it. A cybersecurity assessment establishes your environment baseline and identifies the gaps that most commonly lead to incidents - and a pre-incident engagement means NSP already knows your environment if something does go wrong.
What is cyber incident response and why do NZ SMEs need a provider?
Cyber incident response is the structured process of identifying, containing, and recovering from a cyber attack or security breach. NZ SMEs need a dedicated provider because incident response requires specialist skills, forensic tools, and regulatory knowledge that most small businesses don't have internally - and because the speed of the response directly affects how much damage occurs. A provider engaged before an incident means faster response, better forensic preservation, and a recovery that doesn't start from scratch.
How much does incident response cost for an NZ SME?
Incident response costs vary significantly depending on whether a provider is engaged before or after an incident, the scope of the incident, and the complexity of the recovery. Pre-incident retainer arrangements - which include environment familiarisation, plan documentation, and on-call response capability - are typically far more cost-effective than emergency engagement after an incident has already escalated. Against the average cost of a significant NZ cyber breach, which routinely exceeds $150,000 in direct costs, pre-incident investment is clearly the better financial position.
What's the difference between a managed security service provider and an incident response provider?
A managed security service provider (MSSP) monitors your environment continuously and detects threats before or as they occur. An incident response provider leads the response and recovery after an incident has been identified. Many providers offer both - which is the ideal arrangement, because a provider already monitoring your environment can detect, respond, and recover without the handoff delays and environment-discovery time that separate providers introduce. Our post on 8 MSSP capabilities Auckland SMEs should check covers the monitoring side of this in detail.
What should we do immediately if we think we've been breached?
Isolate affected systems from the network without turning them off - disconnecting from Wi-Fi and ethernet removes network access while preserving forensic evidence. Call your incident response provider immediately rather than attempting to manage it internally first. Notify your cyber insurer within the notification window in your policy - typically 48–72 hours of suspecting an incident. Do not delete, reformat, or restore affected systems before forensic evidence has been preserved. Our post on how to know if your business has been breached covers the indicators and immediate response steps in detail.
Does our cyber insurance cover incident response costs?
Most NZ cyber policies include event response costs - forensic investigation, legal advice, notification costs, and sometimes public relations support. Whether incident response costs are covered, and up to what limit, depends on the policy. Pre-incident retainer costs are typically not covered. Understanding what your policy covers before an incident is significantly more useful than understanding it during one. Our post on what a cyber insurance claim costs NZ businesses covers the coverage and sublimit questions that most SMEs don't ask until it's too late.
How long does it typically take to recover from a cyber incident in NZ?
Most NZ leaders expect recovery to take days. Real-world examples show it often takes weeks or months. The duration depends on the nature and scale of the incident, whether clean backups are available and tested, how quickly containment is achieved, and the complexity of the Privacy Act and insurance obligations that run alongside technical recovery. Ransomware incidents without tested backups typically take the longest - because restoration requires rebuilding systems from scratch rather than recovering from a clean backup.
A 30-minute consultation with NSP covers your current incident response readiness - whether you have a plan, whether it's been tested, and whether the provider relationship you'd rely on in a crisis is actually in place.
Or call us directly: 0508 010 101