What Should Happen in the First 24 Hours of a Cyber Incident?

The first day of a cyber incident is rarely tidy. Information is incomplete, normal communications may be unsafe and pressure builds quickly. A rehearsed response helps the organisation make deliberate decisions instead of creating new problems through panic.

The exact sequence depends on the event. This is a practical framework, not legal advice or a substitute for specialist incident support.

Minutes 0–60: report and establish control

Employees should know how to report suspicious activity immediately. Record what was observed, when it began, which devices or accounts may be involved and what actions have already been taken. Appoint an incident lead and begin a decision log.

Use a trusted communication channel if email or collaboration systems might be compromised. Bring in the relevant technical provider and check insurance notification terms before appointing external specialists where the policy requires it.

Hours 1–4: contain without losing the evidence

Containment may include isolating devices, disabling accounts, revoking sessions, blocking malicious connections or restricting remote access. Avoid indiscriminate deletion and rebuilding until evidence requirements have been considered.

Preserve logs, alerts, suspicious messages and a timeline. Record who performed each action. These details support investigation, regulatory assessment and a reliable recovery.

Hours 4–8: understand scope and business impact

Identify affected identities, endpoints, servers, cloud services and data. Ask what the attacker may still control, how the intrusion began and whether information was accessed or removed. At the same time, map disruption to critical business services and deadlines.

Facts and assumptions should be kept separate. Early certainty is dangerous; update the working assessment as evidence improves.

Hours 8–12: coordinate obligations and communications

Involve leadership, legal advisers, insurers and relevant specialists. Consider contractual, regulatory and data-protection obligations using verified facts. Prepare messages for employees and key stakeholders, but do not speculate publicly or promise recovery times that have not been tested.

Hours 12–24: plan a clean, prioritised recovery

Recovery should follow agreed business priorities. Confirm that backups are safe, rebuild from trusted sources, reset affected credentials and close the route used by the attacker. Monitor restored systems closely and avoid reconnecting them merely to create the appearance of progress.

Actions to avoid

• Do not conceal the event or delay escalation.
• Do not use potentially compromised channels for sensitive coordination.
• Do not destroy evidence through unnecessary wiping or log clearing.
• Do not contact criminals impulsively or make uncoordinated payments.
• Do not declare the incident over before persistence and access have been checked.

Preparation changes the outcome

Keep offline contact details, response roles, insurance information and recovery priorities. Run tabletop exercises so decision-makers experience uncertainty before a real event. After containment, conduct a documented review and track every corrective action.

If you are dealing with an active incident, Astley Digital offers cyber incident recovery support. For preparation and resilience planning, speak to our team.