The first hours of an incident decide how much it will cost. Decisions made in a panic, such as wiping a server or emailing everyone, can destroy the evidence you need and create legal problems that last longer than the technical ones.
Hours 0–4: stabilise
- Assign one incident lead and a small core team; keep a written timeline from the first minute.
- Contain without destroying: isolate affected systems from the network rather than powering them off or reinstalling.
- Preserve evidence: logs, memory where possible, disk images and cloud audit trails.
- Switch to an out-of-band channel if email or chat may be compromised.
Hours 4–24: understand
- Establish scope: which systems, accounts and data are involved, and since when.
- Reset exposed credentials and revoke tokens, starting with administrators and service accounts.
- Involve legal counsel, your insurer (many policies require early notice) and, where relevant, law enforcement.
Hours 24–72: decide and notify
- Assess whether personal data was affected. Under the GDPR, controllers must notify the supervisory authority within 72 hours of becoming aware of a qualifying breach.
- Entities covered by the EU’s NIS2 Directive must send an early warning to their CSIRT or authority within 24 hours of a significant incident.
- In the US, check state breach-notification laws, sector rules and contractual duties to customers.
- Prepare clear, factual communications for customers and staff; avoid speculation.
Prepare before it happens
A written response plan, a contact list, logging that is actually retained, and one tabletop exercise a year make every step above faster and calmer.
Need a second opinion on your situation? Book a free 30-minute consultation.