The first hour shapes the whole incident. This is general guidance; adapt it to your environment and legal advice.
Do
- Contain affected devices by disconnecting them from the network. Keep them powered on so evidence in memory is preserved.
- Preserve logs, emails, screenshots and ransom notes. Note times and who did what.
- Reset credentials for affected and administrative accounts from a known-clean device.
- Notify leadership, legal, your insurer and any provider that can help. Decide who speaks to regulators.
Do not
- Wipe, reinstall or reformat systems before they are investigated.
- Delete files, logs or mailboxes.
- Pay or negotiate without legal and expert advice.
- Speculate publicly before facts are known.
Reporting clocks
In India, CERT-In directions require certain cyber incidents to be reported within 6 hours of noticing them, and the DPDP framework expects personal-data breaches to be intimated to the Data Protection Board and affected people, with a detailed report within 72 hours. Other regulators and regimes set their own deadlines, so confirm with your counsel.