When a cybersecurity incident occurs, the first few hours are critical. This checklist helps you take the right immediate actions, contain the damage, communicate with stakeholders, and begin recovery. Print this guide and keep it accessible to your security team.
Is This a Real Incident?
- Unexpected system outage or data loss
- Suspicious login activity or new user accounts
- Ransom message or extortion demand
- Customer data breach notification
- Malware detected by security software
- Unusual network traffic or system behavior
- Compromised email account or unauthorized access
Phase 1: Detection & Immediate Response (First 30 Minutes)
First Steps
0–30 minutes
- Declare an incident: Alert leadership and your incident response team that a security event has occurred. Use your organization's escalation process.
- Activate your incident response plan: Gather your IR team. If you don't have a formal plan, assemble: IT lead, security point person, management, legal/compliance (if available).
- Isolate affected systems: Disconnect compromised devices from the network immediately. Don't shut down yet—this may destroy evidence needed later.
- Preserve evidence: Before making changes, take screenshots of any suspicious activity, error messages, or unusual behavior. Document everything with timestamps.
- Stop the spread: Reset passwords for administrative and sensitive accounts from a clean device. Consider forcing a re-login for all users.
- Notify key stakeholders silently: Inform CEO, board, legal, and insurance provider (if applicable). Agree on communication strategy before public statements.
Don't Panic—Think Strategically
- Don't immediately shut down systems—this destroys forensic evidence
- Don't delete suspicious files or clear logs—forensics teams need them
- Don't communicate publicly until you understand the scope
- Don't assume it's a small incident—assume worst-case and adjust
Phase 2: Assessment & Containment (30 Minutes – 24 Hours)
Understand What Happened
30 min–24 hours
- Assess scope and severity: How many systems are affected? What data is at risk? Is this ransomware, data theft, availability loss, or something else?
- Check backups: Test that backups are accessible and uninfected. Ransomware often targets backup systems.
- Review access logs: Look for unauthorized logins, new accounts, or privilege escalation. Check both on-premises and cloud systems (email, storage, etc.).
- Quarantine suspicious files: Move malware or suspicious files to an isolated location for analysis (don't delete yet).
- Engage external help if needed: Contact your incident response firm, managed security provider, or law enforcement if the incident is severe, involves ransomware, or affects multiple organizations.
- Determine if data was exfiltrated: Did the attacker copy data outside your network? Check outbound traffic logs and consider whether regulatory notifications are required.
Containment Actions
Stop Further Damage
- Change all passwords (especially admin accounts) from a clean device
- Block malicious IP addresses and domains at your firewall and email gateway
- Disable or reset any compromised user accounts
- Enable multi-factor authentication (2FA) company-wide if not already in place
- Patch known vulnerabilities that may have been exploited
- Monitor for lateral movement—watch for signs the attacker is moving to other systems
- Preserve forensic data before systems are wiped or restored
Phase 3: Communication & Notification (Concurrent)
Who to Notify
Ongoing, timeline depends on incident type
- Internal communication: Brief staff on what happened and what actions to take (password changes, monitoring for phishing, etc.). Be honest but avoid spreading panic.
- Customer notification: If customer data was compromised, determine notification timeline based on regulations (often 30–60 days). Work with legal and communications teams.
- Regulatory notification: Depending on your industry (healthcare, finance, etc.), you may need to notify regulators, state attorneys general, or data protection authorities.
- Law enforcement: Contact FBI, Secret Service (for financial crimes), or local police if the incident involves illegal activity or extortion.
- Business partners and vendors: Notify anyone who has access to your systems or whose data you process.
- Public statement: If the incident is large or will be public, prepare a statement acknowledging the incident, confirming response actions, and directing people to updates.
Communication Template
Key Message Points
- What happened (general description, avoid technical jargon)
- When it was discovered
- What data is affected (be specific)
- What actions are being taken (immediate containment and investigation)
- What people should do now (change passwords, monitor accounts, etc.)
- How to get more information or report concerns
Phase 4: Recovery & Investigation (24 Hours – Weeks)
Restore Systems & Investigate
1–4 weeks (longer for complex incidents)
- Conduct forensic analysis: Work with your IR firm or forensic team to determine how the attack happened, what was accessed, and how to prevent recurrence.
- Restore from clean backups: Only restore systems after you're confident you've removed the attacker's access and tools.
- Patch and harden systems: Apply security patches, disable unnecessary services, and improve firewall rules.
- Monitor for re-infection: Watch for signs the attacker is returning or has backdoors. Monitor for 30+ days.
- Conduct internal review: Determine what security gaps allowed this incident. Plan improvements.
- Document lessons learned: Create an incident report documenting timeline, response effectiveness, and improvements needed.
Key Contact Information (Fill in Now)
Keep This Information Current
- Incident Response Lead: [Name, Phone, Email]
- IT Director/Security Lead: [Name, Phone, Email]
- Legal/Compliance Contact: [Name, Phone, Email]
- CEO/Board Contact: [Name, Phone, Email]
- Insurance Provider: [Phone, Policy #]
- External IR Firm: [Company Name, 24/7 Phone]
- Managed Security Provider: [Company Name, Phone]
- FBI Local Field Office: [Phone Number]
Before the Next Incident: Preparation
The best time to prepare for an incident is before it happens. Make sure you have:
- A written incident response plan that covers roles, responsibilities, and escalation procedures
- Contact list with key stakeholders, vendors, and law enforcement (update quarterly)
- Backup and recovery procedures that are tested monthly
- Security monitoring (SIEM, log aggregation, or endpoint detection) so you catch incidents early
- Incident response tabletop exercises at least annually so your team knows what to do
- Cyber insurance that covers incident response and notification costs