Good incident response is calm, practised and clear about who decides what.
The first 72 hours set the course. Decisions on containment, evidence and communication made early are hard to undo later.
Key points
- Clear roles beat heroic effort
- Containment and evidence must be balanced
- Regulatory clocks start early
How this guide is organised
The guide has 11 chapters. Each one stands on its own, so you can read them in order or go straight to the topic you need.
- Preparation: roles, contacts and the incident plan
- The first hour: detect, confirm and contain
- Declaring an incident and setting severity
- Preserving evidence without slowing recovery
- Containment options and their trade-offs
- Communicating with staff, customers and the board
- Regulatory clocks: NIS2, GDPR and DORA
- Eradication and safe recovery
- Working with your MDR provider and external responders
- Lessons learned and the post-incident review
Who this guide is for
It is written for IT and security leads, risk and compliance owners and the managers who sign off on the work. This guide follows the order of a real incident.