Incident Response: The First 72 Hours
What to do from the first alert to recovery: roles, containment, evidence, communication and the regulatory clocks that start running.
Utforska Incident Response-guiden
Elva kapitel, vart och ett läsbart för sig. De flesta innehåller ett verktyg du kan använda medan du läser.
What good incident response looks like
Good incident response is calm, practised and clear about who decides what.
Preparation: roles, contacts and the incident plan
Preparation decides how the first hour goes. Know who leads, who decides and who to call.
The first hour: detect, confirm and contain
The first hour is about confirming what is happening and stopping it from spreading.
Declaring an incident and setting severity
A clear severity scale tells everyone how much effort and escalation is needed.
Preserving evidence without slowing recovery
Evidence helps you understand the attack, support insurance claims and meet reporting duties.
Containment options and their trade-offs
Containment can be narrow or broad. Each choice has a cost to the business.
Communicating with staff, customers and the board
Clear and honest communication protects trust during an incident.
Regulatory clocks: NIS2, GDPR and DORA
Several reporting duties may apply to the same incident, each with its own clock.
Eradication and safe recovery
Recovery means removing the attacker completely before restoring service.
Working with your MDR provider and external responders
External specialists add capacity and experience during a serious incident.
Lessons learned and the post-incident review
A blameless review turns an incident into lasting improvements.
Boka en säkerhetsgenomgång på 30 minuter.
Ingen säljpresentation.
Prata med en Sverigebaserad analytiker. Vi går igenom din säkerhetsnivå, kartlägger dina luckor och ger dig en tydlig bild av läget, på vanlig svenska.
Boka en kostnadsfri genomgång