// incident response · guide

Incident Response: What To Do in the First 24 Hours

Early decisions can affect containment, evidence and recovery. This is a general planning guide, not an emergency-response service or a substitute for your incident plan. Priorities and timing depend on safety, business impact and the facts available.

First priority: confirm and contain

• Verify the signal — is this a real compromise or a false positive?
• Contain affected systems while preserving evidence where feasible. Follow the incident lead's direction on isolation, volatile evidence and any shutdown or restart; immediate safety and containment needs may change the order.
• Start an incident log: timestamps with time zones, actions, decisions, owners and evidence sources. Preserve originals and record any collection or handling limitations.

Next: assess scope and affected access

• What was accessed, from where, since when? Pull authentication logs, VPN records, and endpoint telemetry before retention windows eat them.
• From a trusted environment, plan credential rotation, token revocation and session invalidation according to exposure, privilege and service dependencies. Avoid signalling completion while attacker access remains.
• Identify affected data and involve qualified legal or privacy advisers promptly to determine any notification duties and deadlines. They depend on the jurisdiction, facts and applicable agreements.

In parallel: communicate and stabilise

• Use a designated incident lead and agreed internal and external communication owners. Choose a trusted channel if the ordinary email or identity system may be compromised.
• Notify legal counsel and, where applicable, your insurer — before making public statements.
• Do not pay, promise, or publish anything under pressure without advice.

The mistakes that make it worse

Avoid unnecessary evidence changes, unsupported public statements and response coordination over a potentially compromised channel. Record why urgent containment actions were taken, then use a post-incident review to address root causes and lessons.

Prepare before an incident through an agreed response plan, named decision owners, reliable contacts and exercises. The NIST SP 800-61 Rev. 3 guidance places response within wider cybersecurity risk management.