Loading...
Loading...
When a breach happens, the first hours are critical. Companies with incident response plans have 58% lower breach costs. Here's what to do before, during, and after a cyber attack.
58%
Lower breach costs with IR plan
181
Days average to identify breach
60
Days average to contain breach
47%
Organizations with IR plans
Are you actively under attack right now?
If this is an emergency, start with Step 1 below. Call your IT support or incident response provider immediately.
Take notes with timestamps. Screenshot error messages. Don't delete anything yet.
Evidence preservation is critical for investigation and insurance claims
Disconnect compromised devices from network. Don't turn them off if ransomware - preserve memory.
Unplug ethernet, disable WiFi, but leave systems running unless actively spreading
From a known-clean device, change passwords for email, banking, and admin accounts.
Use a device NOT connected to the compromised network
IT support, management, legal, insurance. Know who to call BEFORE an incident.
Don't use compromised systems to communicate about the incident
What systems were affected? What data was accessed? When did it start?
The initial assessment is often incomplete - assume wider impact
Files encrypted, ransom note displayed
Isolate immediately, don't pay ransom without expert advice, restore from backups
Resources: CISA Stop Ransomware, FBI IC3
Fraudulent wire transfer, impersonation emails discovered
Contact bank immediately (may recover funds within 24-72 hours), preserve emails
Resources: FBI IC3, Bank fraud department
Unauthorized access to sensitive data confirmed
Determine scope, preserve logs, prepare notification (legal requirements vary)
Resources: State AG notification requirements, PCI-DSS if payment data
Unable to access accounts, unauthorized activity
Reset credentials from clean device, enable MFA, review account activity
Resources: Account recovery procedures, credit freeze (Equifax, Experian, TransUnion)
Don't pay ransom without professional advice
Don't delete logs or evidence
Don't restore from backup without verifying it's clean
Don't use compromised systems to communicate
Don't ignore the incident hoping it resolves itself
Don't wait to notify affected parties if legally required
Don't attempt forensics without preserving evidence first
Don't publicly announce before understanding scope
The time to create an incident response plan is NOW, not during a crisis.
Contact List
CriticalKey phone numbers: IT, management, legal, insurance, vendors, FBI/CISA
Roles & Responsibilities
CriticalWho makes decisions? Who communicates externally? Who handles technical response?
Communication Plan
CriticalHow to communicate during incident (secure channels), templates for notifications
System Inventory
HighList of all systems, their importance, and how to isolate them
Backup Verification
CriticalWhere are backups? When were they last tested? How long to restore?
Legal Requirements
HighNotification timelines, regulatory requirements, insurance policy details
External Resources
MediumIncident response firms, forensics providers, legal counsel (pre-arranged)
Recovery Procedures
HighStep-by-step instructions for rebuilding systems from known-good state
Data breach notification (requirements vary by state)
Check your state AG website
A plan that hasn't been tested is just a document. Conduct tabletop exercises where you walk through scenarios: "It's 3am and ransomware just encrypted our file server. What do we do first?"
Run exercises quarterly. Update the plan based on lessons learned.
The best incident response is one you never need. Implement strong defenses, but have a plan ready just in case.