Checklist: First Hour of a Cyber Incident

1. 01Isolate, do not erase. Disconnect affected systems from the network. Do not power them off, wipe, or reimage them; that destroys evidence.
2. 02Do not contact or pay the attacker.
3. 03Switch to out-of-band communication. Assume email and chat may be monitored; use phones or a separate account.
4. 04Write down what you know. Time of discovery, who found it, which systems, and what was observed. Take photos or screenshots.
5. 05Preserve logs. Do not delete files, logs, or accounts, even suspicious ones.
6. 06Hold off on sweeping changes. Mass password resets or system rebuilds can alert the attacker before their access is mapped. Make them on your responders’ advice.
7. 07Notify the right people. Leadership, legal counsel, and your cyber insurer. Many policies require prompt notice and the use of approved response firms.
8. 08Consider reporting. In the United States, incidents can be reported to the FBI and to CISA.
9. 09Call for help. Report an Active Incident to Acervus

General guidance only, not legal advice. Follow the direction of your counsel and insurer.

Download the one-page PDFAll resources