- 01First six hours: activate the IR team with defined roles and a single incident commander, initial containment (isolate suspected compromised systems), preserve evidence (memory, disk, logs, timeline), open the incident bridge as single source of truth, notify legal / executive / communications / insurance.
- 02First 24 hours: establish scope, identify initial access vector, determine which systems / data / identities are compromised, run parallel threads for technical investigation and legal/regulatory analysis. Preserve, do not delete.
- 0324-72 hour window: eradication and recovery planning. Confirm complete attacker removal before declaring containment. Stage recovery tied to confidence in eradication. Capture postmortem-quality notes in real time, not 'we'll write it up later.'
- 04What goes wrong: premature restoration without eradication, unilateral communications without legal review, failure to preserve evidence in the rush to remediate. Each costs multiples in eventual outcome — extended dwell time, regulatory penalties, litigation exposure.
The first 72 hours of an incident determine most of the outcome. Discipline beats heroics. The teams that recover fastest and best are the ones that follow a known cadence rather than improvising from scratch.
The first six hours
- 01Activate the incident response team — defined roles, single incident commander
- 02Initial containment — isolate suspected compromised systems
- 03Preserve evidence — memory, disk, logs, timeline
- 04Open the incident bridge — single source of truth for status
- 05Notify stakeholders — legal, executive, communications, insurance
The first 24 hours
Establish the scope. Identify the initial access vector. Determine the scope of compromise (which systems, which data, which identities). Begin parallel threads for technical investigation and legal/regulatory analysis. Preserve, do not delete.
The 24-72 hour window
Eradication and recovery planning. Confirm complete attacker removal before declaring containment. Plan recovery in stages tied to confidence in eradication. Capture lessons in real time — postmortem-quality notes, not 'we'll write it up later.'
What goes wrong
Premature restoration without eradication. Unilateral communications without legal review. Failure to preserve evidence in the rush to remediate. Each of these has cost organizations multiples in eventual outcome — extended dwell time, regulatory penalties, litigation exposure. The discipline of the first 72 hours is the single highest-leverage factor in the response.