The first hour, step by step
Read it all here, free. Print-and-fill version by email if you want it.
First 10 minutes
- Disconnect affected machines from the network: pull the cable, kill Wi-Fi.
- Do NOT wipe, reboot, or 'clean' anything yet. Evidence first.
- Start an incident log: time, who noticed what, every action taken.
Don't power machines off. Memory holds evidence; disconnect the network instead. The one exception: a machine actively encrypting files gets powered off.
Minutes 10 to 30
- Notify your incident lead and your IT/MSP contact.
- Identify what's affected: which machines, which accounts, which data.
- Change passwords from a known-clean device: admin accounts first, then email, then banking.
Minutes 30 to 60
- Call your cyber insurance carrier's hotline. Many policies require notice before you spend money on response.
- Decide: handle it in-house, or bring in a forensics/IR firm now.
- Set the next check-in time. Panic improvises; plans schedule.
Who has to be notified
- Personal data of state residents: state attorney(s) general + affected individuals. Connecticut: no later than 60 days.
- Health information (PHI): HHS + individuals within 60 days of discovery.
- Payment cards: your processor or merchant bank, immediately.
- Any covered incident: your insurer, before spending on response.
- Fraud, extortion, wire theft: FBI at ic3.gov.
That's a starting point, not legal advice; your breach counsel makes the final call.
The PDF adds:
- A fill-in contact tree: insurer, counsel, forensics, roles and backups
- The full notification-deadline table
- Ready-to-use internal and client communication scripts
- The post-incident review checklist