The IT manager of a mid-sized metal processing firm in Bursa described what happened last year: ransomware encrypted production-connected servers at 3 a.m., no one noticed until 6:30, and the company had no written response procedure in place. Three days of production stopped. The insurer declined the claim because no incident logs had been kept. This is not an isolated story. It reflects a pattern seen repeatedly across similarly scaled Turkish companies. The real question is no longer ‘will we be attacked?’ but ‘what do we do when we are?’ Cyber resilience is the organisational answer to that second question. And that answer stays on paper without a team to execute it.
A working assumption has taken hold in serious security practice over recent years: breach is inevitable. No matter how strong the prevention layers, a determined attacker or an internal mistake will eventually find an opening. Accepting this is not defeatism — it is maturity. Because once an organisation accepts it, energy shifts from defending only the perimeter to also asking how quickly recovery can happen. This is where the Incident Response Team — known internationally as CSIRT or CERT — becomes the operational core of institutional resilience. Without a team, procedures may exist on paper, but procedures do not execute themselves under pressure.
The structure of an incident response team scales with the organisation, but the core roles remain constant. An incident coordinator, a technical analysis lead, a communications owner, and a legal and compliance liaison — these four roles must be filled even in the smallest team. In the Turkish SME context, filling these roles through cross-training existing staff is often the only realistic path rather than hiring dedicated headcount. An accounting manager can own the communications role; a systems administrator can carry the technical analysis function. What matters is that roles are defined and owned before an incident occurs. If the question ‘who does what?’ is being asked during a crisis, the team was never built.
Drill discipline is what transforms an incident response team from a list of names into actual capacity. Tabletop exercises are the most accessible starting point: without touching live systems, the team works through a scenario to examine how decisions will be made, who will communicate with whom, and in what sequence steps will be taken. Run at least twice a year, these exercises surface gaps in procedures under safe conditions rather than under real stress. Among larger Turkish retail chains, PCI-DSS compliance requirements have driven card data breach scenarios into regular tabletop practice. Smaller companies have been slow to adopt this discipline at their own scale, but the cost of delay compounds with each passing month.
Recovery target design forms the technical backbone of incident response work. Two metrics are decisive here: RTO (Recovery Time Objective) and RPO (Recovery Point Objective). Without defining these two values, backup systems, disaster recovery infrastructure, and cloud backup contracts cannot be evaluated in any meaningful way. If a four-hour RTO is the target for an e-commerce operation, the technical infrastructure and human capacity to meet that four hours must be built in advance. Across Turkish SMEs in 2019, many have not defined these values. Backup infrastructure exists, but the actual recovery time is unknown. This is equivalent to purchasing an insurance policy without reading the coverage terms.
One counterargument deserves a direct response: ‘We are a small company — we are not a target.’ This assumption remains widespread and continues to cause damage. A significant share of ransomware attacks are not targeted; they propagate automatically toward any system with an exploitable weakness. The majority of cyber incidents affecting Turkish SMEs during 2018 and 2019 originated not from targeted campaigns but from unpatched systems or weak password policies. Scale does not protect you. Preparation does. Building an incident response capability does not require a large IT budget: a procedure document, defined roles, a communication tree, and two drills per year represent a starting point that most organisations can reach with existing resources.
Cyber resilience is not a technology project. It is an organisational capacity question. Technology supports that capacity but does not create it. An incident response team is the structure that ensures protocol runs instead of panic when a breach occurs. There is no perfect moment to start building it. The practical recommendation for Turkish SME managers is this: before the next ransomware wave arrives, define your roles, schedule your first tabletop exercise, and set your RTO and RPO values. Finding the answers now is always less expensive than searching for them after an attack has already begun.
This article was originally written in Turkish by Gökhan MERCANOĞLU on May 20, 2019 and has been automatically translated into English and other languages using machine translation.