The first 72 hours: which clocks run when a small organisation suspects an incident

Three sets of clocks, three audiences

The first set is binding on a defined group. PSD-12 applies to persons within the National Payment System. Where a successful cyberattack occurs, paragraph 11.13 requires a preliminary report to the Bank within 24 hours. Paragraph 11.14 then requires an impact assessment within a month of the incident becoming known, and paragraph 11.15 says it must state financial loss, data loss and availability loss.

The second set comes from the draft Data Protection Bill. A controller must notify the supervisory authority without undue delay and within 72 hours of becoming aware of a personal data breach, unless a high risk is unlikely, and must explain any delay (section 22). A processor must tell the controller without undue delay. Where the risk to people is high, the controller must also tell them in plain language, unless the data was rendered unintelligible, for example by encryption (section 23). The Bill is a draft. It binds no one today, but its clocks show what to design for.

The third set is guidance. The National Cyber Security Incident Management Guidelines, issued by NAM-CSIRT in 2026, say an incident should be classified within the first 24 hours of detection and operators should inform NAM-CSIRT within five hours after classification. An incident is major if it meets stated criteria, among them potential compromise of another entity, impact on critical services, impact on the confidentiality, integrity or availability of customer information, and activation of disaster recovery. Reporting to NAM-CSIRT is expected for high-impact incidents even from organisations outside its constituency, and voluntary reporting is encouraged.

Classification comes first

The guidelines classify incidents on four levels across four impacts: people, economy, operations and reputation. Level 0 is negligible. Level 1 is limited to a single constituent. Level 2 involves more than one constituent, or relevant impact on one. Level 3 reaches national scale or causes tangible hazards to citizens. A practical consequence follows. An organisation with no classification routine cannot meet a five-hour clock, because the clock starts when the incident is classified.

A first-hour sequence

A short sequence is one a small team rehearses. Write down what happened and the time, in one running log. Contain the damage: revoke the credential, disable the account, switch off the feature or roll back the change. Preserve evidence before changing anything else, because logs and audit trails are what a regulator and a court will ask for. Tell the person who decides on notification. If you handle other organisations’ data, tell them without waiting for the investigation to finish, because their own deadline might already be running.

The processor duty deserves emphasis. Under the draft Bill, a processor must tell the controller without undue delay, and the controller’s 72 hours begin when the controller becomes aware. A processor who waits days to be sure leaves the controller blind while harm grows, and breaches its own duty.

Decide in advance

Four decisions are cheap before an incident and costly during one. Who classifies, and by what criteria? Who notifies each audience, and with what template? What is the record of whether affected data was encrypted, since the draft Bill makes this fact central to whether individuals must be told? What is the test, held at least once a year, to prove the plan works?

PSD-12 itself requires plans to be tested at least twice a year for critical systems, with a recovery time objective of two hours. A small organisation outside the payment system is not bound by this, but the targets are a sound benchmark.

A timeline to rehearse

A single worked timeline helps a team see how the clocks overlap. At hour zero, the first person suspects an incident. Write the time down. In the first hour, confirm what is happening, contain it and start the log. Within the first 24 hours, classify the incident on the four-level matrix and, if the organisation is in the payment system and an attack has succeeded, send the Bank its preliminary notification. Within five hours of classification, tell NAM-CSIRT if the incident is major. Within 72 hours of becoming aware, a controller notifies the data protection authority, if the law is in force and the risk is not unlikely to be high. Within a month of the incident becoming known, a payment participant sends the Bank an impact assessment.

Different organisations will hit different subsets of these. A pure software supplier with no payment role has only the guidance and its contracts. A bank has all of them. A clinic holding patient records faces the Bill’s clocks and the sensitivity of health data. Knowing which subset applies to you is the first piece of preparation, and it takes an afternoon.

What to write down, and for whom

Section 22(5) of the draft Bill requires a controller to document any personal data breach, comprising all facts relating to it, its effects and the remedial action taken, in a form enabling the authority to verify compliance. A running log kept from the first hour supplies this. The notice to the authority must at least describe the nature of the breach with, where possible, the categories and approximate number of people concerned, its likely consequences, and the measures taken or proposed (section 22(4)).

PSD-12 asks for an impact assessment stating financial loss, data loss and availability loss in minutes. A single incident record, with fields for each, serves both. NAM-CSIRT’s guidelines add communication duties: customers should be kept informed of major incidents and data breaches where their data has potentially been compromised, communication should be timely and transparent and include the steps taken, users should be taught what, how and where to report, and anonymous reporting should be encouraged. The guidelines also require a communication plan, kept up to date from past incidents.

Mistakes small teams make

Four mistakes recur. The first is waiting for certainty: the clocks start at suspicion, and a team which waits to confirm the cause loses hours it cannot recover. The second is fixing before preserving: restarting a server or deleting an account destroys the evidence a regulator and a court will ask for. The third is a single point of knowledge: the one person who knows the plan is on leave. The fourth is silence toward customers: processors who delay telling customers turn a contained event into a trust problem.

Each has a cheap remedy. Write the time. Preserve before you fix. Name a deputy for every role. Draft the customer notice in advance and keep it where staff find it. A plan on paper which has never been rehearsed fails under pressure, so run the tabletop exercise this quarter.

What the national guidelines expect before an incident

The 2026 guidelines do not begin with notification. They begin with capability. Section 8.2.1 says operators and private entities must be prepared and able to respond to detected cyberattacks through appropriate procedures covering all phases of incident response: preparation, identification, containment, eradication and recovery. The listed elements include a plan approved by management and reviewed annually, assigned roles, detection tools, a contact list with NAM-CSIRT, sector response teams, regulators and law enforcement, regular simulation exercises, continuous monitoring, classification by impact and urgency, the ability to suspend network access for compromised users or devices, copies of critical configuration for restoring service, and identification and notification of impacted customers with an estimated time to resolution.

Three further expectations stand out. Entities must be able to respond during working and off hours. Monitoring should run around the clock, 24 hours a day, and is outsourced or managed in-house by choice, with management accountable either way (section 8.3.1). And plans, endorsed by senior leadership and the board, are to be developed within one year of the guidelines taking effect or when the Authority directs, reviewed at least annually, and tested by an annual independent assessment of networks and systems, which includes simulations, vulnerability assessments, penetration testing and access control reviews (section 8.4.1).

Roles, and the register an auditor will ask for

The guidelines ask a set of plain questions of any plan. Who is the internal contact point and how is the person reached? Who does which task? Who manages the incident from the business and technical side, with authority to decide, from start to finish? Who liaises with senior management, engages an external partner, files a complaint with law enforcement or informs regulators, and speaks to the press? The governance table then assigns management, communications, technical support, an incident response manager and legal. Management decides, for instance, whether to disconnect a compromised system and when to start clean-up. Legal keeps the response within legal, regulatory and policy boundaries. Smaller organisations are allowed to use corporate management directly, while larger ones add a crisis team.

Section 8.4.3 describes the register. For each incident it records the date and time of discovery, a description, the central contact person to whom it was reported, existing controls and remedial action, notifications made and to whom (data protection authority, affected individuals, third parties), and the external parties involved. The register has a second use: the types, frequency and cost of incidents feed the next risk assessment. A small provider keeping this register from its first incident has most of what a regulator or an auditor asks to see.

What this means for organisations in Namibia

Write three templates now: the 24 hour notice to the Bank for payment participants, the breach notice to a regulator or customer, and the plain-language notice to affected people. Each should have blanks for facts, effects and remedial action.

Hold a tabletop exercise once a year. Start from a plausible case, such as a lost laptop with an open session, and walk through each clock, each audience and each decision.