Skip to content

Cyber Incident Preparedness & Response

Digital lock appearing on a laptop

Cyber Incident Preparedness & Response provides end-to-end, real-time support for cyber incident readiness, response, and recovery. The service is delivered through the Police Digital Service’s (PDS) National Management Centre (NMC).

How it works

This service includes facilitated exercising of incident response plans, nationally coordinated incident management, and expert-led investigation and containment activities. Forces benefit from structured testing, real-time support, and continuous improvement of their cyber resilience.

Delivered through the NMC, the service also includes access to the Defend As One Cadre of nationally trained senior officers (at Gold Commander level), ensuring consistent and effective coordination across forces during major incidents.

Benefits
  • Improved readiness and confidence in cyber response.
  • Minimised operational disruption during incidents.
  • Consistent national coordination and learning.

Funded member label

Extended access label

Learn more about member benefits on our dedicated Members page.

What we need
  • Cyber Incident response plans and exercise objectives
  • Stakeholder contacts.
  • Incident details and system access (if applicable).
  • Escalation routes and force-level coordination points.
  • Agreement to engage with national response frameworks.
What you get
  • Review of Cyber Incident Response plans with recommendations offered for improvements.
  • Tailored cyber incident exercises. and evaluation reports.
  • Coordinated incident management and containment support.
  • Investigation findings and recovery actions.
  • Post Incident analysis identifying areas for improvement.

Use cases

A UK police force participated in a simulated ransomware exercise facilitated by PDS, testing its incident response plan under pressure.

The exercise revealed gaps in escalation procedures and the flow of communications, leading to targeted improvement actions.

Sometime later, the force experienced a genuine malware incident. The Cyber Incident Response team coordinated containment and recovery.

Additionally, police forces have also engaged with the Defend As One Cadre, ensuring national alignment and rapid restoration of services.

Find out how we can help