BLOG

When a threat, an extortion attempt, a leak, a security incident on the road or a sudden public story arrives, the first impulse is often to do too much, too quickly, with too many people on the call. That is how facts get confused, messages leak, and early decisions become hard to unwind. This guide explains what a crisis advisor does in the first 48 hours, and the sequence that should govern those hours: facts, decision-makers, communications and containment.

It is written for principals, family office heads, chiefs of staff and counsel who may have to act before a full picture is available. It is not a substitute for legal advice, and it is not a plan tailored to a particular family or firm. It is the discipline that crisis and high-risk advisory brings when the office is already under pressure.

Why the first 48 hours matter

The first two days of a crisis are rarely when the matter is resolved. They are when the facts are scarcest, emotions are highest, and small choices — who is told, what is written down, whether a payment is held — begin to shape everything that follows. A calm advisor’s first job is not to produce a complete narrative. It is to stop the situation getting worse while a reliable picture is built.

Some incidents also start legal or regulatory clocks almost at once. Under Article 33 of the UK GDPR, a controller must notify a personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people’s rights and freedoms. That duty will not apply to every private crisis. When personal data may be involved, the first 48 hours are when the office must establish whether it does.

Official cyber guidance makes the same point about composure. The UK National Cyber Security Centre’s advice on what to do in the first hours of a disruptive attack asks leaders to set a calm, professional tone from the outset and to avoid rushing to judgement. The same discipline applies well beyond cyber: to threats, extortion, sensitive disputes, incidents during travel, and sudden reputational exposure.

A calm sequence, not a scramble

Think of the first 48 hours as four overlapping tasks, taken in a deliberate order: establish the facts, name the decision-makers, control communications, and contain the incident. They will run in parallel, but the order of thinking matters. Communications and containment should not be based on rumour, and a large group should not decide by committee what a small, authorised group has not yet framed. The advisor keeps that sequence intact, keeps the circle tight, and coordinates specialists so the principal hears one clear line of advice.

1. Establish the facts

The first hours are for sorting what is known from what has been reported and what is only assumed. An advisor will typically work through a short set of questions and write the answers down: what has happened, and when the office first became aware of it; who is affected, and whether anyone is in immediate danger; what has already been said, paid, posted or promised; which devices, accounts, premises or travel arrangements are involved; and what remains unknown.

That record matters. The NCSC asks organisations, in those first hours, to keep a single, authoritative log of what was discovered, when, which decisions were taken, by whom and why. The picture will be incomplete. The point of the log is to stop the version of events drifting as more people join the conversation.

Two cautions follow. Do not tidy up messages, devices, rooms or accounts before counsel and, where needed, a specialist investigator have advised. And treat surprising instructions with care: a call or message that appears to come from the principal, especially one demanding an urgent payment, may be part of the incident rather than a way to resolve it. The call-back and dual-approval habits in our guide to voice-clone and deepfake fraud apply under pressure as much as on an ordinary working day.

2. Name the decision-makers

A crisis widens the circle unless someone deliberately keeps it small. Well-meaning staff, family members and service providers all want to help, and each additional person is another channel for confusion or leakage. The advisor’s second task is to help the client name a small decision group and give it clear authority.

The NCSC’s first-hours guidance calls this an incident command structure: a group with authority to make containment, recovery and communication decisions, and to keep a shared view of the situation as it develops. In a private family or office, that group is the principal, or a person the principal has already authorised, plus counsel and a very short list of people who can actually act. It should be able to say who can authorise a payment or a refusal, a statement, a change of travel or residence, or a call to the police or a regulator. Deputies should be named for the hours when the principal cannot be reached. An advisor does not replace the lawyers; we work alongside counsel and other specialists so the client is not left to reconcile conflicting advice alone.

3. Control communications

Most early damage in a private crisis is done with words: a wider briefing, a well-meant post, a rushed comment, or a conversation held on a channel that may already be compromised. The advisor’s third task is to decide who may speak, to whom, and through which channel — and who may not.

The default in the first 48 hours is often a holding position, not a full public statement. The NCSC notes that early, controlled communication with key stakeholders helps prevent conflicting messages, and that the office should first establish whether its usual channels can be trusted. If they cannot, conversations about the response should move to a pre-agreed method, such as a telephone call on a known number.

The audience list should be written down, and each audience should get only what it needs. This is also the moment to involve brand and reputation advisory support if a leak, a negative story or an online attack is already in motion, or is likely to be. Reputation work in the first 48 hours is less about a polished narrative than about preventing an unforced comment from becoming the story.

4. Contain the incident

Containment means stopping the situation from spreading, without closing off options that will be needed later. The tests are the same in every case: are people safe, is further loss being prevented, and is evidence being preserved? Physical risk comes first. If information is leaking or accounts may be compromised, lock what can be locked and avoid wiping the trail. If money is being demanded, hold action until verification is complete. If the press or a counterpart already has a story, avoid an unforced reply.

Official guidance is cautionary here. In its incident management advice, the NCSC warns organisations not to over-react during the containment phase: more information may be needed first, and over-reaction can cause more damage than the incident itself. Switching everything off, issuing a detailed public statement, or opening a negotiation without counsel can close options that a slower decision would have kept open. Containment in the first 48 hours is not resolution; it is the work that makes a considered resolution possible.

This is also when legal and insurance duties should be checked, not postponed until the matter settles. The UK GDPR example above is one such clock. Counsel will know whether others apply, and those questions need to be asked while the facts are still being established.

What to have ready beforehand

The first 48 hours go more calmly when the office already has a named escalation path, out-of-hours contacts, a way to reach the principal and counsel that does not depend on a single device or account, and a rule that unusual payment or travel instructions are verified before they are executed. Those points sit naturally alongside the wider questions in our family office security checklist. Confidential tabletop exercises, run beforehand, are how a decision group finds the gaps that a real incident will not give it time to debate.

This guide is general guidance. It does not replace legal, insurance or specialist investigative advice, and it is not a plan tailored to a specific principal or office.

Frequently asked questions

Is a crisis advisor the same as a lawyer or a public relations firm?

No. A crisis advisor provides security and strategic judgement, and coordinates the people the client already needs — counsel, investigators, protection specialists and communications support — so that decisions stay in one place. Lawyers remain essential for legal privilege, regulatory duties and any negotiation or report. The advisor does not replace them.

When should a private office call a crisis advisor?

When the matter is outside the office’s usual experience, when several specialists are already being pulled in and the advice is starting to conflict, or when the principal wants a discreet, low-profile response rather than a large, visible team. Earlier is better than later: the first 48 hours are harder to reconstruct once messages have been sent and decisions taken.

What if the first 48 hours have already passed?

The same sequence still helps, but it starts with a careful reconstruction: what is now known, who has already been told, what has already been promised or paid, and which options remain open. Some steps cannot be undone. The decision group, the communications rule, the record, and any missed containment can still be tightened.

Will anyone know that an advisor is involved?

Involvement should be kept as quiet as the situation allows. Counterparties and outside parties usually only know what the client chooses to share. The circle of people briefed inside the family or office should stay as small as the work permits.

Does this only apply to cyber incidents?

No. Cyber incidents are one setting in which official guidance on the first hours is unusually clear, and in which legal clocks may start quickly. The same sequence applies to threats, extortion, sensitive disputes, security incidents during travel and sudden reputational exposure.

8Dimension is led by a former owner and CEO of a large security company, with analyst experience and a record of advising government-level officials. We advise a small number of principals, families and private offices by referral. If you would like a discreet conversation about how your office would handle those first 48 hours, we would be glad to arrange a private introduction.