Incident Response: The First 72 Hours
What to do from the first alert to recovery: roles, containment, evidence, communication and the regulatory clocks that start running.
Explore the Incident Response Guide
Eleven chapters, each one readable on its own. Most include a tool you can use as you read.
What good incident response looks like
Good incident response is calm, practised and clear about who decides what.
Preparation: roles, contacts and the incident plan
Preparation decides how the first hour goes. Know who leads, who decides and who to call.
The first hour: detect, confirm and contain
The first hour is about confirming what is happening and stopping it from spreading.
Declaring an incident and setting severity
A clear severity scale tells everyone how much effort and escalation is needed.
Preserving evidence without slowing recovery
Evidence helps you understand the attack, support insurance claims and meet reporting duties.
Containment options and their trade-offs
Containment can be narrow or broad. Each choice has a cost to the business.
Communicating with staff, customers and the board
Clear and honest communication protects trust during an incident.
Regulatory clocks: NIS2, GDPR and DORA
Several reporting duties may apply to the same incident, each with its own clock.
Eradication and safe recovery
Recovery means removing the attacker completely before restoring service.
Working with your MDR provider and external responders
External specialists add capacity and experience during a serious incident.
Lessons learned and the post-incident review
A blameless review turns an incident into lasting improvements.
Get a 30-Minute Security Briefing.
No Pitch Deck.
Talk to a Sweden-based analyst. We'll review your posture, map your gaps and give you a clear picture of where you stand, in plain language.
Book a Free Briefing