An employee receives an email with the subject line “Salary Review”. Expecting information about a possible pay increase, they click the link and enter their work credentials on what appears to be the company’s login page. Minutes later, the IT team notices unusual activity on the account. The business now needs an incident response plan that tells the right people what to do, who takes responsibility and how to contain the threat before it spreads.
The challenge is no longer just identifying a suspicious email. The team must investigate the activity, secure the affected account, assess the potential impact and communicate with the right people. Without a clear process, valuable time can be lost while everyone works out what should happen next.
The Problem: What Happens After a Security Alert?
Many organisations invest in cybersecurity tools to monitor systems, detect suspicious activity and protect sensitive information. However, detecting a potential threat does not automatically resolve it.
Consider the salary review example. The employee reports the email to the helpdesk, but the support technician is unsure whether to treat it as a routine request or a security incident. The report is forwarded to another team, the security team is notified late, and nobody is certain who should investigate first.
Meanwhile, the compromised credentials could allow an attacker to attempt further access.
This is where gaps in incident management become costly. Without a defined process, organisations may experience:
- Delayed investigations: Teams spend valuable time gathering information that should have been captured when the incident was reported.
- Unclear ownership: Departments assume someone else is handling the problem.
- Poor communication: Employees and management receive incomplete or inconsistent updates.
- Limited accountability: Teams struggle to establish which actions were taken and why.
- Repeated incidents: Organisations miss opportunities to learn from previous security events.
These problems do not always indicate a lack of technology. Sometimes, the real weakness lies in how people, processes and security tools work together.
Insight: Why Nigerian Businesses Need a Clear Incident Response Plan
For Nigerian businesses, cybersecurity preparedness goes beyond installing security software. Organisations also need a clear process for identifying, reporting and responding to security incidents before they escalate.
Nigeria’s National Cybersecurity Policy and Strategy 2021 provides a national framework for strengthening cybersecurity and improving the country’s ability to address cyber threats. The Nigerian Computer Emergency Response Team (ngCERT) also supports cybersecurity awareness and incident response efforts.
The Nigeria Data Protection Act 2023 adds a legal dimension. Under Section 40, a data controller must notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a personal data breach that is likely to put individuals’ rights and freedoms at risk, and must inform affected individuals immediately where the risk is high. Time lost working out who owns an incident is time taken from that window.
At the organisational level, this means businesses should establish an incident response plan that defines who takes action, how incidents are reported, who investigates them and how communication is managed throughout the process.
The need for a structured approach is also reflected in the US National Institute of Standards and Technology’s (NIST) Special Publication 800-61 Revision 3, published in April 2025. It explains how organisations can incorporate incident response into broader cybersecurity risk management, helping them prepare for incidents, reduce their impact and improve their response over time.
For Nigerian businesses managing customer information, financial records and critical operations, these principles are particularly relevant. A security alert is only useful if the right people know what to do next.
What Should an Incident Response Plan Include?
A useful plan should give employees and IT teams a clear sequence of actions without making the process unnecessarily complicated.
1. Report and Record the Incident
Employees need a clear way to report suspicious emails, unusual account activity and other potential security issues. The report should capture relevant details, including the time of detection, affected systems and actions already taken.
2. Assess the Risk
Next, the responsible team should assess the incident’s urgency and potential impact. A suspicious email that nobody has opened may require a different response from an account that shows signs of unauthorised access.
3. Assign Ownership and Investigate
The plan should identify who investigates the incident, who authorises containment measures and when the team must escalate the issue. Clear ownership prevents reports from moving between departments without progress.
4. Communicate and Contain
Meanwhile, the appropriate teams should coordinate their actions. Depending on the findings, they may need to disable compromised credentials, isolate an affected device or block malicious activity. The response should follow approved procedures and preserve evidence where necessary.
5. Document and Review
Finally, teams should record the findings, actions taken and recovery steps. They can then review the incident to identify gaps in existing controls and improve the response process.
These steps provide the foundation. The next challenge is making the process practical enough for teams to follow consistently.
How ManageEngine Tools Support an Incident Response Plan
A documented process tells people what to do. The right tools help them carry out those actions, track progress and gather the information they need to investigate an incident.
For Tranter IT, two ManageEngine solutions are particularly relevant: Log360 and ServiceDesk Plus.
ManageEngine Log360: Detect and Investigate Security Threats
ManageEngine Log360 provides security information and event management (SIEM), threat detection, investigation and security orchestration capabilities. It helps security teams analyse security telemetry and investigate suspicious activity across their IT environments.
Returning to the salary review example, Log360 can help a security team investigate relevant login activity and other available security logs after an employee enters credentials on a suspicious website.
The team can examine the available evidence to determine whether the account shows signs of compromise and decide which response actions are necessary.
ManageEngine ServiceDesk Plus: Assign and Track Response Activities
ManageEngine ServiceDesk Plus supports IT service management, including incident recording, prioritisation, assignment, notifications and escalation workflows.
Once the organisation identifies a potential security incident, ServiceDesk Plus can help coordinate the work required to address it. The team can record the issue, assign responsibility, track investigation tasks and escalate the incident according to established rules.
For example, the assigned technician can document the actions taken to secure the affected account, while the appropriate team monitors progress and communicates updates.
How the Two Tools Work Together
- Log360 supports detection and investigation. It helps the security team identify suspicious activity and examine relevant evidence.
- ServiceDesk Plus supports incident coordination. It helps the organisation record the issue, assign ownership, track actions and manage escalation.
- The incident response plan guides decisions. It defines who acts, which procedures to follow and when to involve other stakeholders.
ManageEngine documents incident detection integrations involving Log360 within its ServiceDesk Plus incident management ecosystem. However, the precise workflow depends on the product edition, integration configuration and organisational requirements.
Together, these capabilities can help organisations connect security monitoring with structured incident management. The tools support the process, while the organisation’s plan establishes the responsibilities and decisions that guide the response.
From a Suspicious Email to a Coordinated Response
Imagine the employee reports the salary review email after clicking the link.
With a clear incident response plan, the security team uses Log360 to review relevant login activity and other available security logs. Where the organisation has configured the integration, Log360 alerts can create tickets in ServiceDesk Plus, and incidents can also be raised as tickets manually. The ticket is prioritised and assigned to a named owner, the technician records the actions taken to secure the account, and the team tracks progress and escalates according to the organisation’s rules. The team assesses whether other systems or information may be affected, communicates relevant updates and records the outcome.
Without this structure, staff may spend valuable time forwarding emails, identifying the right contact and requesting information that nobody has recorded properly.
The difference is not that technology eliminates every delay. Rather, the combination of a clear process and appropriate tools reduces uncertainty about what should happen next.
Conclusion: Make Incident Response a Prepared Process
A phishing email with the subject line “Salary Review” may look like an ordinary workplace message. However, if an employee enters their credentials on a malicious website, the organisation needs to respond quickly and methodically.
An effective incident response plan gives employees and IT teams a clear process for reporting, investigating, containing and reviewing security incidents. Supported by tools such as ManageEngine Log360 and ServiceDesk Plus, it can help organisations improve visibility, clarify ownership and coordinate their response activities.
Start by reviewing your current process. Who receives a security report? Who takes responsibility? How are incidents escalated, and where are the outcomes documented?
This Cybersecurity Awareness Month, review your incident response plan and identify one step that needs clearer ownership. A more coordinated response starts with knowing what happens next.
Need help strengthening your cybersecurity incident response process? Speak with Tranter IT about the right tools and procedures to help your business detect, manage and respond to security incidents more effectively.
