Cyber Incident Response: What a Business Should Do in the First 24 Hours

If you suspect a cyber incident, contain it, preserve evidence, call the right people and do not rush into decisions you cannot undo. In practice that means isolating affected devices from the network without powering them off unless advised, notifying your IT or security provider and your cyber insurer, contacting an attorney experienced in data breaches, and documenting what you see. Acting calmly in the first day often determines how costly the incident becomes. This guide gives a practical sequence. It is general information, not legal or forensic advice.

Hour 0 to 1: Recognize and contain

Typical signs: ransom notes, files that will not open or have strange extensions, accounts locked out, unexpected password reset messages, unfamiliar forwarding rules in email, unusual bank transfers, or alerts from your security tools.

Immediate steps:

1. Alert your incident lead. Decide who is in charge; a single decision maker avoids chaos.
2. Disconnect affected devices from the network: unplug the network cable or turn off Wi-Fi. Powering off can destroy volatile evidence, so follow your provider's guidance if you can reach them.
3. Do not delete files, reformat or reinstall until forensic advice is obtained.
4. Disable compromised accounts and reset credentials from a known clean device, especially administrator and email accounts.
5. Stop sending sensitive messages over possibly compromised email; use phone or an alternate channel.
6. Write down the time you noticed the problem and what you saw.

Hour 1 to 4: Call for help

Use this order unless your plan says otherwise:

Keep the insurer's hotline number printed or stored offline, because your email or file server may be down. See cyber insurance requirements.

Hour 4 to 12: Scope and preserve

• Preserve evidence: keep logs, ransom notes, suspicious emails, screenshots and affected systems. Ask your responder how to capture images.
• Identify scope: which systems, accounts and data are affected? Is attacker access ongoing?
• Secure backups: make sure backups are disconnected from the affected network and not encrypted or deleted. Do not restore until you know the attacker has been removed, or you may reinfect.
• Check for persistence: attackers often create new accounts, email forwarding rules or scheduled tasks.
• Review cloud and email logs for unusual sign-ins and mailbox rules.
• Reset credentials broadly after containment, including service accounts, and enforce MFA.

Hour 12 to 24: Decide and communicate

Legal and notification

Many laws may apply, depending on what data was involved and where affected people live. All 50 states have breach notification laws, and sector rules such as HIPAA's Breach Notification Rule apply to covered entities and business associates. Financial institutions under the FTC Safeguards Rule have specific obligations. Contracts with customers may also require notice within a set time. Your attorney should lead these decisions.

Internal communication

Tell employees what to do and not do, for example: do not discuss on social media, do not open suspicious attachments, report anything unusual, and direct media questions to a designated person.

Customer and public communication

Wait for legal and forensic input before making statements about scope or cause. Premature or inaccurate statements can create liability and confusion.

Ransom decisions

Paying a ransom is a serious decision with legal and practical risks. The FBI and CISA generally discourage payment because it does not guarantee data return and may encourage further attacks. Sanctions rules may also restrict payments to certain groups. Involve counsel, your insurer and law enforcement before any decision.

What not to do

• Do not wipe systems before evidence is preserved.
• Do not contact the attacker without guidance.
• Do not restore from backups until you know the threat is removed.
• Do not assume the incident is over after a single password reset.
• Do not delay notifying your insurer, since policies often have notice requirements.
• Do not blame individuals publicly; you need people to report quickly next time.

One-page response plan you can build today

1. Names and phone numbers: incident lead, IT provider, insurer hotline, attorney, bank contact.
2. Location of offline backups and who can authorize a restore.
3. List of critical systems and the order to restore them.
4. Decision rules: who can isolate systems, who talks to customers, who talks to media.
5. A printed copy stored somewhere accessible without computers.

Test it with a short tabletop exercise: read a scenario such as "ransomware is found on the file server at 7 a.m. Monday" and walk through each step. See also common mistakes.

Example timeline (illustrative)

A 20-person firm finds a ransom note at 8:10 a.m. By 8:30 the office manager unplugs the file server and notifies the IT provider. At 9:00 the owner calls the insurer's hotline, which assigns a breach attorney and forensic firm. By noon the responders confirm that the attacker entered through a mailbox without MFA. The firm resets credentials, verifies that offline backups are intact and begins a staged restore the next day. The details are invented to show the sequence, not to predict an actual case.

Frequently asked questions

Should I turn off the computer?

Isolate it from the network first. Powering down can erase useful evidence in memory, so follow your responder's advice if available.

Do I have to tell customers?

It depends on the data, the law and your contracts. An attorney can determine duties and timing.

What if I do not have an incident plan?

Use the steps above, call your IT provider and insurer and build a plan afterward. Consider an incident response retainer or review whether your insurer's panel responders are enough.

Can I handle a small incident myself?

Some minor events, such as a single phishing click with no sign of access, may be handled internally, but when in doubt, treat accounts and devices as compromised and get advice.

Sources

• CISA — ransomware guidance and incident reporting
• FBI Internet Crime Complaint Center — report cybercrime
• Federal Trade Commission — Data Breach Response: A Guide for Business
• U.S. Department of Health and Human Services — HIPAA Breach Notification Rule