The first hour of an incident is when people make their worst decisions. Adrenaline is high, information is thin, and everyone wants to do something. Some of those instincts are good, such as cutting off an attacker. Others are destructive, like wiping a machine that held the only evidence of how the attacker got in.

A short, rehearsed plan lets you act quickly without acting blindly. Here is a version small teams can adopt.

Before Anything Else: Who Is in Charge?

Confusion about authority wastes more time than any technical problem. Decide in advance:

• Incident lead: one person who coordinates and makes calls. This is not necessarily the most technical person.
• Technical responder(s): those who investigate and contain.
• Communications owner: the person who speaks to staff, customers and, if needed, the press.
• Decision-maker for business trade-offs, such as taking a system offline.

During the incident, write down who holds each role. If your team is two people, say so explicitly and name who covers when one is unavailable.

Minutes 0 to 15: Confirm and Calm

1. Record what was reported. Who noticed, when, what they saw, and what they did. Write it down, with times.
2. Open a single channel for incident communication, ideally one that doesn’t depend on the possibly compromised system. If email may be compromised, use a phone call or a separate messaging tool.
3. Judge severity roughly. Is sensitive data at risk? Is the attack ongoing? Are critical services affected?
4. Tell people what not to do: don’t delete files, reboot machines, or run cleanup tools until someone responsible says so.

Minutes 15 to 40: Contain Without Destroying Evidence

Containment limits damage; it isn’t the same as fixing. Common actions, from least to most disruptive:

Action	When to use	Caution
Reset credentials and revoke sessions for affected accounts	Suspected account compromise	Reset from a trusted device; enforce MFA
Disable a compromised account	Active misuse	Preserve its logs first
Isolate a device from the network	Suspected malware	Leave it powered on if advised; don’t wipe
Block a malicious address or domain	Known malicious source	Attackers can switch quickly
Take a service offline	Active data loss or ransom activity	Weigh business impact; get the decision-maker
Disconnect backups	Ransomware in progress	Protect them before encryption spreads

Isolating a device by disconnecting its network is generally preferred over powering it off, because memory may contain evidence. Follow your tooling’s guidance, and when in doubt, ask a qualified incident responder.

Minutes 40 to 60: Preserve and Scope

• Preserve evidence: save relevant logs, take disk or memory images if you have capability, and keep affected devices untouched. Note chain of custody if legal action is possible.
• Scope the incident: which accounts, devices and data might be involved? Use your asset inventory and logs.
• Check for persistence: new accounts, forwarding rules, scheduled tasks, unknown apps granted access.
• Decide whether to bring in help: an incident response provider, your cyber insurer’s hotline if you have a policy, legal counsel, or law enforcement. Insurance policies often require early notification, so check yours now rather than during a crisis.

A Hypothetical Example

An employee reports clicking a link and entering their password on a page that looked like the company’s sign-in. It is mid-afternoon.

The incident lead logs the report and time. The administrator resets the employee’s password from a clean device, revokes active sessions, and checks that MFA is registered to the employee’s own device and not a new one. Next they review recent sign-ins for that account, looking for unfamiliar locations or devices, and inspect the mailbox for new forwarding or deletion rules. They find a forwarding rule created an hour ago. They remove it, preserve a copy of the evidence, and check whether the account sent any messages to colleagues.

Within the hour, the scope is clear and contained, and the communications owner warns staff to watch for suspicious messages. Whether notification to clients is required depends on what the account could access and on the law where you operate, so counsel is consulted.

Communicate Honestly and Narrowly

• Share facts you have confirmed, say what you don’t know yet, and say when the next update will arrive.
• Don’t speculate about attackers or blame individuals publicly.
• Reduce the circle for sensitive details, as attackers sometimes monitor internal channels.
• Keep a timeline of decisions and their reasons. You will want it later.

Legal duties to notify regulators or affected people vary by jurisdiction and sector, and the clock may start sooner than you expect. Involve qualified legal advice early.

What to Prepare Before You Need It

• A one-page contact list with phone numbers kept outside your normal systems
• Logging that actually exists and is retained long enough to be useful
• Backups you have tested and that an attacker can’t easily reach
• A rehearsal: a short tabletop exercise walking through a scenario once or twice a year
• Pre-agreed authority to isolate systems without waiting for a committee

Frequently Asked Questions

Should we pay if hit by ransomware? There is no universal answer, and it involves legal, ethical and practical factors. Involve counsel and specialists, and note that payment doesn’t guarantee recovery.

Should we shut everything down immediately? Not automatically. Contain what is affected and weigh business impact. Abrupt shutdowns can destroy evidence and disrupt operations without helping.

When do we tell customers? When you know enough to say something accurate and, where required, within legal deadlines. Take advice before deciding.

Do small companies really need an incident plan? Yes, a short one. Even a single page naming roles and first steps prevents the worst early mistakes.

What is the most common first-hour mistake? Wiping or rebuilding a system before capturing evidence, which makes it hard to know what was taken or how the attacker entered.

Next Step

Write the one-page contact and roles sheet today, covering who leads, who investigates, who speaks, and which phone numbers work if email is down. Then schedule a thirty-minute walk-through with the people on it.