When an incident starts, you won't rise to the occasion so much as fall back on whatever you prepared. People are tired, facts are scarce, and the most senior person in the room may want answers nobody has. Most of the first hour's useful decisions can be made in advance, on a quiet afternoon.

Prepare the things you can't improvise

  • A contact sheet held outside your systems. Include internal leads, your IT provider, your cyber insurer, your lawyer and any retained response firm. Keep it on paper and on personal phones, because your directory may be unavailable.
  • An out-of-band channel. Assume the attacker can read your corporate email and chat. Agree on an alternative beforehand, and make sure the right people have already joined it.
  • Pre-agreed authority. Decide who may disconnect a production system without further approval, and put it in writing.
  • Logs that survive. Check retention now. If authentication logs roll over after seven days, your investigation of a three-week-old intrusion ends before it starts.
  • Your insurer's conditions. Many policies have notification terms or panel-vendor requirements. Find out what yours says before you need it.

For a fuller structure, NIST SP 800-61 Revision 3 sets out incident response recommendations as part of wider cyber risk management.

Who decides

Three roles matter in the first hour, and in a small organisation one person may hold two of them, though the incident lead shouldn't also be doing hands-on technical work.

  • Incident lead: owns the timeline, assigns work and makes operational calls. This person coordinates and does not touch keyboards.
  • Technical lead: works out what happened and proposes containment options.
  • Business decision-maker: a senior person with authority to accept the consequences, such as taking a revenue-generating service offline.

Add someone responsible for communications as soon as anyone outside the immediate team needs to know. Keep the group small. Every extra person on the call slows it down and widens the circle of people who may repeat speculation.

The hour itself

  1. Minutes 0 to 15: confirm and convene. Check that the signal is real, open the out-of-band channel, name an incident lead and start a written log with times, actions and who took them.
  2. Minutes 15 to 30: scope what you can. Which accounts, systems and data might be involved? Write "unknown" where you don't know. Decide on your immediate priority, whether that is protecting people, keeping a service running or stopping data leaving.
  3. Minutes 30 to 45: contain, deliberately. Disable compromised accounts, revoke sessions, and isolate affected hosts from the network. Weigh each action against the risk of tipping off an attacker who still has other ways in, but don't let that concern excuse inaction if harm is ongoing.
  4. Minutes 45 to 60: preserve and notify. Secure the evidence listed below, brief the decision-maker, call your insurer and lawyer if the situation warrants it, and set a time for the next update.

Evidence

Your instinct will be to clean up. Resist it until you have what you need, because a wiped host can't tell you how the attacker got in, and you can't confidently declare the incident over if you don't know that.

  • Isolate machines rather than powering them off. Memory contents disappear at shutdown and may hold the only trace of what ran.
  • Take disk and memory captures or cloud snapshots of affected systems before rebuilding them.
  • Export logs and extend their retention immediately, including identity provider, firewall, cloud audit and email logs.
  • Record who handled each piece of evidence, and when, in case it later matters to an insurer, regulator or court.

Communications

Keep to verified facts and say what you don't yet know. Tell staff what to do and whom to refer questions to. Don't name a cause or an attacker early, since first theories are frequently wrong and public corrections are costly.

If personal information may be involved, start the privacy assessment during this first hour. New Zealand's Privacy Commissioner expects notification within 72 hours of becoming aware that a breach is notifiable, as a guide, and you can notify in stages. The National Cyber Security Centre also takes incident reports and can offer guidance.

Decisions about paying a ransom don't belong in the first hour. They need legal advice and a clear picture of your backups, neither of which you will have yet.

What to do this week

Run a 30-minute tabletop exercise. Give your team one scenario, such as a stolen administrator account found on a Friday evening, and ask who decides, how they reach each other if email is down, and how far back the logs go. Write down the gaps you find, and fix the contact sheet first.