Cyber Incident Response: What to Do First and How to Prepare

These are steps your own team can take while you bring in your technical responders. They are general practices drawn from the CISA playbooks, and your incident response plan, attorney and insurer may add steps of their own. Steps to limit harm need not wait for the investigation to finish: responders investigate and take containment steps at the same time, and adjust as they learn more.

1. Record what you observed. Note the time, what appeared on screen, who noticed and which systems or accounts are involved. Photos of error or ransom messages can help.
2. Use a trusted communication channel. If email or chat may be compromised, use phone calls or a meeting bridge that runs outside the affected systems. Attackers may monitor the messages defenders send.
3. Bring in your responders. Contact the people who manage your systems and security, and the person in your organization who can approve disruptive steps such as taking systems offline.
4. Limit further harm. If ransomware or active spread is suspected, prompt isolation of affected devices or network segments may be needed, following your incident response plan and your responders’ direction. CISA lists “isolating impacted systems and network segments from each other and/or from non-impacted systems and networks” as a key containment activity, while considering how to keep essential services running.
5. Preserve evidence where possible. Isolate affected devices rather than powering them off, wiping, rebuilding or restoring over them, unless your responders advise otherwise. Those steps can erase information investigators need. CISA also lists capturing forensic images to preserve evidence among its key containment activities.
6. Coordinate account changes. Password resets, account lockouts and credential rotation are important containment steps. Responders coordinate their timing with other containment actions to reduce the chance of alerting the attacker before access is removed.
7. Contact your attorney and your cyber insurer early. Many policies set their own reporting steps and may require you to use an approved response firm. Some notice deadlines can arrive before the investigation or recovery is finished, so assess reporting duties with your attorney from the start and throughout the response. Decisions about legal, regulatory, insurer and law enforcement notice are yours to make with your attorney.
8. Keep facts and theories apart. Track what is confirmed and what is still a working theory. Clear records support later decisions, reports and notices.

Incident response is the planned way an organization finds, contains and recovers from a security incident, then learns from it. CISA’s playbooks follow the incident response phases defined by the National Institute of Standards and Technology (NIST):

The phases are a guide, not a straight line. CISA notes that many activities are iterative. Responders investigate while taking steps to limit further harm, and they update their assessment as new evidence comes in. If new signs of compromise appear during containment or recovery, responders return to analysis.

Is it an incident or a routine event?

Most security events are not incidents. NIST describes an event as any observable occurrence in a system or network. An incident is an occurrence that actually or imminently jeopardizes the confidentiality, integrity or availability of information or a system, or that violates security policies or acceptable use policies.

Signs that call for a full incident response:

• An attacker moving between systems, stealing passwords or copying data out
• An intrusion that touches more than one user or system
• A compromised administrator or service account
• Ransomware or other destructive activity
• Unauthorized access to your cloud tenant, email or a key business application

Events that can often be handled as routine, once assessed:

• A phishing click where no account or device was compromised
• Common malware on one computer that was blocked or removed
• A lost or stolen device, once you have assessed what data it held, whether it was encrypted and protected by a passcode or sign-in, and whether accounts or saved credentials on it may be exposed. The absence of visible misuse is not enough on its own.

When you are unsure, treat it as a possible incident until someone qualified rules it out. Early assessment helps preserve evidence and supports an informed response.

Early response is more effective when key decisions are made in advance, which is why CISA puts preparation first. A practical starting list:

• A written incident response plan. Who decides, who calls whom and what the first steps are, kept where people can reach it even if your network is down.
• An accurate list of systems. Servers, devices, networks, cloud services and vendor-hosted applications, including which ones hold sensitive information.
• Logging that is collected centrally and kept. Investigators rely on logs to reconstruct what happened, and logs kept in one place help responders trace how an attacker moved.
• A baseline of normal activity. Knowing what normal looks like makes unusual activity stand out.
• Tested backups and restores. Backups protected from changes, with restores and failover tested on a schedule.
• Practice. Tabletop exercises walk your leadership through a realistic scenario so roles and decisions are clear before an incident.
• An alternate way to communicate. Phone numbers and a meeting bridge that do not depend on your email or chat.

What to have ready before an incident

Responders work to build as complete a picture as possible while they take steps to limit harm, and they revisit their conclusions as evidence comes in. CISA lists these core questions:

• How did the attacker first get in?
• How are they reaching the environment now?
• Are they exploiting software vulnerabilities?
• How are they controlling compromised systems?
• Have they set up a way to come back, and how?
• Which accounts are compromised, and with what level of access?
• How are they exploring the network?
• Have they moved to other systems, and how?
• Has data been taken? If so, what data, and how?

Your logs, your system list and the notes from your first hour can help answer these questions. The answers also inform the facts your attorney uses to assess notice duties.

Containment aims to limit further damage and remove the attacker’s access. In CISA’s words, “The objective is to prevent further damage and reduce the immediate impact of the incident by removing the adversary’s access.” It usually involves more than one action, and CISA asks responders to weigh:

• Business impact. What happens to operations, services and customers when a system goes offline.
• Time, resources and effectiveness. How long containment takes, what it needs and whether it is full or partial.
• Evidence. How each action affects collecting and preserving evidence.

CISA also notes: “Some adversaries may actively monitor defensive response measures, and shift their methods to evade detection and containment.” Responders therefore try to understand the attacker’s reach while weighing the risk of allowing access to continue, and they take containment steps as the picture develops. The right approach depends on the attack. When ransomware or active spread is suspected, prompt isolation may be needed; containing a skilled attacker who is quietly active in a network can call for a more carefully timed approach.

Containment choices are business decisions as well as technical ones, which is why it helps to know in advance who can approve them.

Some incidents begin with a known vulnerability that has not yet been patched. CISA’s companion Vulnerability Response Playbook focuses on vulnerabilities that attackers are actively exploiting, and it follows five phases: Preparation, Identification, Evaluation, Remediation, and Reporting and Notification.

Sources that help prioritize fixes include CISA’s Known Exploited Vulnerabilities (KEV) catalog, the NIST National Vulnerability Database and vendor security advisories. As each system is checked and fixed, CISA describes its status this way:

If a vulnerability has been exploited in your environment, CISA’s playbook calls for incident response activities to begin immediately.

Your organization remains responsible for its incident response, including legal and notice decisions. ALCON DTS can help you put preparation basics in place, identify and address weaknesses, and keep the records your attorney and insurer may ask for. When an alert fires, the ALCON DTS expert team works the issue with you until it is back under control.

ALCON DTS does not provide legal advice, does not send breach notices on your behalf and does not certify compliance.

Reporting and notice duties should be assessed throughout the response, not only at the end, because some deadlines can arrive before the investigation or recovery is finished. A security incident is not always a legally reportable breach: each law and contract has its own definitions and triggers. Texas law, for example, defines a “breach of system security” as “unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information.” Whether a duty applies is a decision for your organization and your attorney.

• Texas breach notification (Bus. & Com. Code 521.053). If an incident involves sensitive personal information, Texas law requires notice to affected individuals without unreasonable delay and no later than the 60th day after you determine the breach occurred. If at least 250 Texas residents are involved, you must also notify the Texas Attorney General as soon as practicable and no later than the 30th day after that determination, using the Attorney General’s online form. Senate Bill 768 (effective September 1, 2023) set the 30-day Attorney General deadline and electronic filing. See our Texas Breach Notification Law guide.
• Texas Cybersecurity Safe Harbor (SB 2610). Qualifying Texas businesses with a framework-based cybersecurity program can raise a defense against exemplary damages in a breach lawsuit. It does not change breach notice duties. See Texas SB 2610 Cybersecurity Safe Harbor.
• NIST Cybersecurity Framework 2.0. Respond and Recover are two of the framework’s six Functions, and NIST SP 800-61 Rev. 3 maps incident response to CSF 2.0. See our NIST Cybersecurity Framework 2.0 guide.
• Federal reporting to CISA and the FBI. CISA accepts voluntary incident reports at cisa.gov/report, and the FBI takes cybercrime complaints through the Internet Crime Complaint Center (IC3). The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) will require some reports from covered entities, but CISA says reporting under CIRCIA is not required until its final rule takes effect, and CISA is still working on that rule. Your attorney can tell you whether any reporting duty applies to you today.
• Industry rules, contracts and insurance. Health care, payment card, defense and other rules, along with customer contracts and cyber insurance policies, can carry their own incident reporting steps and deadlines. Reviewing them with your attorney before an incident helps your team meet them.

• Cybersecurity Incident & Vulnerability Response Playbooks (CISA, November 2021, TLP:CLEAR; PDF)
• NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (NIST, April 2025)
• NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide (NIST, August 2012, withdrawn April 3, 2025)
• Known Exploited Vulnerabilities Catalog (CISA)
• Report a cyber incident (CISA)
• StopRansomware.gov (CISA)
• Internet Crime Complaint Center (FBI IC3)
• Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (CISA)
• Texas Business and Commerce Code, Chapter 521, including Sec. 521.053 (Texas Constitution and Statutes)
• Data Breach Reporting (Office of the Texas Attorney General)

This guide adapts public guidance from CISA’s Cybersecurity Incident & Vulnerability Response Playbooks (November 2021, TLP:CLEAR). CISA does not endorse ALCON DTS or its services.

Last reviewed: October 28, 2026

This page is general information about cyber incident response and related rules, not legal advice for your situation.