How to Shorten Your Trusttime: Three Highly Actionable Steps to Sharpen Cyber Crisis Decision-Making

Additional resources

Three Highly Actionable Steps to Strengthen Your Leadership Team’s Cyber Crisis Readiness

Cybersecurity crisis readiness is measured by how quickly leaders are able to establish control while the facts are unclear and pressure continues to escalate.

Three Decisive Moves for Cyber Leaders to Modernize Security Assurance in the Era of AI

The gulf between the way in which organizations test security and how rapidly their environments are evolving calls for three decisive adjustments from cybersecurity leaders.

Cybersecurity Awareness Resources

ISACA offers Information Cybersecurity resources across audit & assurance, governance, enterprise, information security, and risk topics.

AAISM—Advanced in AI Security Management

For CISM and CISSP holders with experience in AI security, ISACA Advanced in AI Security Management enhances skills to identify, assess and mitigate risk across enterprise AI solutions.

The most expensive sentence in a cyber crisis is often: “We need more information.”

Sometimes that sentence is responsible. Often, it is where trusttime begins to bleed: the critical window between discovering an incident and demonstrating to stakeholders that leadership is in control. Leaders wait for certainty, legal for scope, security for confirmation, communications for approved language and the board for assurance. Customers, regulators and journalists, however, do not wait at all.

This blog post gives business leaders three practical ways to shorten trusttime before a crisis forces the issue: map the decisions that matter, preauthorize predictable actions and audit where decision speed breaks down.

Consider Change Healthcare. In February 2024, a ransomware attack disrupted one of the most important payment and claims-processing networks in the US health care system. Andrew Witty, then chief executive of parent company UnitedHealth Group, told Congress the attack caused “incredible disruption” across the healthcare system, including pharmacists having to submit claims manually and a rural family medicine practice struggling to make payroll.

The picture worsened as the investigation unfolded. On 12 February, attackers used compromised credentials on a Change Healthcare Citrix remote-access portal that did not have multifactor authentication; nine days later, ransomware was deployed. UnitedHealth disconnected affected systems, worked to restore payment flows and Witty later said the decision to pay a ransom was his. Press reporting put the payment at US$22 million.

The scale kept growing as Change Healthcare later notified the US Department of Health and Human Services that approximately 192.7 million individuals had been impacted. Witty also told Congress that, as of 26 April, 2024, UnitedHealth had advanced more than US$6.5 billion in accelerated payments and no-interest, no-fee loans to thousands of providers.

This is the leadership problem hidden inside many cyber incidents: the first crisis is technical; the second is decisional.

I introduced trusttime in an earlier ISACA blog post as the speed at which organizations reassure people when systems bend and applied it to crisis readiness in the first part of this series. In a cyber crisis, leaders protect that window through decisions made before certainty arrives. IBM’s 2026 Cost of a Data Breach Report gives that point a sharper edge: global breach costs reached a record high, with the increase driven by higher detection, escalation and lost business costs.

That pressure is compounded by regulatory clocks. In the US, public companies must disclose material cybersecurity incidents within four business days after determining materiality. In the EU, NIS2 can require an early warning within 24 hours for significant incidents where the regime applies.

The practical implication is simple: leaders shorten trusttime by designing decisions before pressure arrives. So, how organizations achieve this?

Step 1: Map your crisis decision architecture

Crisis readiness tells you whether leaders know their roles. Decision architecture goes one layer deeper: it defines the operational, legal, financial and communications decisions that must move in the first 24 to 72 hours of a serious cyber incident.

Bring together the CEO, CISO, General Counsel, COO, CFO and Communications Lead. Start with the practical calls that determine whether the organization creates visible control or loses another hour in debate, not only the headline decisions a regulator or board will eventually force.

Use a decision architecture map:

By the end of the session, leaders should have one page that answers three questions:

• Who decides?
• What evidence is enough?
• When does delay become escalation?

The map forces difficult conversations before the crisis asks them in public. Who can disconnect a supplier if the service is still generating revenue? Who can approve emergency spend at 2 a.m.? Who sets the ransom negotiation posture if operations is under pressure and legal is still assessing risk? These questions may be uncomfortable in a workshop, but they are brutal during a live incident.

A decision map earns its place only if it removes ambiguity before ambiguity becomes visible. Once ownership, evidence and escalation thresholds are clear, the next task is to remove predictable approval delays.

Step 2: Preauthorize high-frequency crisis decisions

Some crisis decisions are predictable and should not need fresh permission during the first hour.

Build a standing authority register for actions that repeatedly appear in serious incidents, including:

• Engaging breach counsel and activating forensic support
• Notifying the board chair and contacting law enforcement
• Issuing a holding statement and opening a customer support channel
• Suspending a supplier connection or authorizing emergency spend

Use this structure:

The output is not a policy document. It is a permission structure.
Preauthorization prevents leaders from spending the first critical hours asking whether they are allowed to do the things everyone already knows will be necessary. It protects judgment from being trapped in approval chains while the clock is already running.

This is where many organizations lose trusttime: the team is active and people are working hard but the work is stuck behind authority questions that should have been settled months earlier.

By the end of this step, the leadership team should know which actions can begin immediately, which require escalation and which boundaries cannot be crossed without executive approval. Once that authority is clear, the next question is whether those decisions actually move at the speed the crisis demands.

Step 3: Run a decision-speed audit

After every serious incident, near miss or executive tabletop, audit the speed of decisions, not only the quality of technical response.

The US Cybersecurity and Infrastructure Security Agency (CISA) frames exercises as practical mechanisms to examine plans and procedures, identify improvement areas and inform future planning. NIST’s updated incident-response guidance, SP 800-61 Revision 3, also places incident response inside broader cybersecurity risk management, rather than treating it as an isolated technical ritual.

For executives, that leads to a sharper question: where did decision-making slow down?
Use a trusttime loss register. The examples below are illustrative and should be tailored to your regulatory obligations, operating model and risk profile.

This turns the usual post-incident question from “Did we respond?” into “Where did trusttime disappear?”

The output should be a short decision-speed report covering:

• The slowest decisions
• The cause of delay
• The executive owner
• The structural fix
• The retest date

If the same delay appears twice, it is no longer a lesson learned. It is a governance weakness.

That audit also changes the quality of board reporting. Instead of telling directors that the incident response plan was activated, management can show where decisions moved, where they stalled and what changed before the next test.

Trusttime is protected before the breach, in the quiet decisions leaders make about authority, evidence and speed.