A method of responding to a cyber-security attack, comprising receiving a cyber-security alert for the cyber-security attack at a cyber-data management node , the cyber-data management node operating on a server associated with a network; analyzing the received cyber-security alert by a mediation component of the cyber-data management node ; displaying a network security map including a network diagram representing the network; displaying a plurality of countermeasure icons by a reporting component of the cyber-data management node in the network security map; displaying a plurality of network security element icons in the network security map; displaying a plurality of action plans in the network security map, the plurality of action plans including countermeasure actions being automatically identified based on a category of the cyber-security attack and an approved cyber-security policy to determine a course of action to respond to the cyber-security attack; displaying an icon correlation area in the network security map; receiving a user input that correlates at least one countermeasure icon from the plurality of countermeasure icons with at least one network security element icon from the plurality of network security element icons, the at least one countermeasure icon corresponding to a countermeasure, the at least one network security element icon corresponding to a network security element, the receiving the user input including receiving the user input that drags and drops the at least one countermeasure icon to the icon correlation area and the at least one network security element icon to the icon correlation area; and applying the countermeasure to the network security element to respond to the cyber-security attack. receiving a cyber-security alert for the cyber-security attack at a cyber-data management node , the cyber-data management node operating on a server associated with a network; analyzing the received cyber-security alert by a mediation component of the cyber-data management node ; displaying a network security map including a network diagram representing the network; displaying a plurality of countermeasure icons by a reporting component of the cyber-data management node in the network security map; displaying a plurality of network security element icons in the network security map; displaying a plurality of action plans in the network security map, the plurality of action plans including countermeasure actions being automatically identified based on a category of the cyber-security attack and an approved cyber-security policy to determine a course of action to respond to the cyber-security attack; displaying an icon correlation area in the network security map; receiving a user input that correlates at least one countermeasure icon from the plurality of countermeasure icons with at least one network security element icon from the plurality of network security element icons, the at least one countermeasure icon corresponding to a countermeasure, the at least one network security element icon corresponding to a network security element, the receiving the user input including receiving the user input that drags and drops the at least one countermeasure icon to the icon correlation area and the at least one network security element icon to the icon correlation area; and applying the countermeasure to the network security element to respond to the cyber-security attack. <EOS>