Incident response: who does what in the first hour

A security incident rarely announces itself clearly. It starts as a strange email sent from your account, a payment that didn't arrive, a locked file with a ransom note, or a call from a client asking why you sent them a new bank account. What you do in the first hour shapes how much it costs.

This guide is the company-level plan: who's in charge, who gets called, and in what order. For step-by-step help with a specific problem, use the existing guides: what to do if an account is compromised and what to do if your site is hacked.

Before anything happens: three things to set up

1. Name an incident lead and a backup. One person makes decisions during an incident. It's usually the owner or the person who owns your security plan. Name a backup for when they're on a plane.

2. Write a contact sheet. Keep it on paper and somewhere outside your main systems (a printed copy, and a personal phone note for the lead). Include:

Incident lead and backup, with mobile numbers
IT provider or managed service provider
Web developer or agency
Bank fraud line and your account manager
Cyber insurer's claims or breach hotline, and your policy number
Lawyer, ideally one with data breach experience
Payment processor support
Key vendors (email provider, payroll, accounting)

3. Know where your backups are and who can restore them. See why backups are your safety net.

The first hour

Take chargeName the lead, start a log, call the bank if money moved
Contain and get helpContain without destroying evidence, call your insurer, bring in help
Communicate safelyMove to a safe channel and call a lawyer if personal data is involved

Stage 1 of 3: Take charge

Minute 0 to 5: name the lead and start a log. Whoever notices the problem tells the incident lead immediately. The lead starts a written log: what was noticed, when, by whom, and every action taken after. Use paper or a device you're confident isn't affected.

Minute 5 to 15: if money moved, call the bank now. For a fraudulent wire or bank transfer, speed matters more than anything else in this list. Call your bank's fraud line, ask them to try to recall the payment, and file a report with the FBI's Internet Crime Complaint Center (IC3) if you're in the US. Then continue below.

Stage 2 of 3: Contain and get help

Minute 5 to 20: contain without destroying.

Disconnect an affected computer from the network (unplug the cable or turn off Wi-Fi). Don't power it off or wipe it unless an expert tells you to; that can destroy evidence.
Reset the password on a compromised account from a clean device, sign out all sessions, and check two-factor settings for anything added by the attacker.
Check email forwarding rules and filters on compromised mailboxes. Attackers often add rules to hide replies.
Temporarily disable accounts you suspect are compromised.

Minute 15 to 30: call your insurer. If you have cyber insurance, call the claims or breach hotline before hiring forensic or recovery firms yourself. Many policies require prompt notice and may only cover vendors from their own panel. See cyber insurance.

Minute 15 to 45: bring in technical help. Call your IT provider, web developer, or the response firm your insurer assigns. Give them your log.

Stage 3 of 3: Communicate safely

Minute 30 to 60: move communications to a safe channel. If email may be compromised, don't discuss the incident over it. Use phone calls or a messaging group on personal devices. Tell staff what to do and what not to do, briefly.

Within the hour: call a lawyer if personal data may be involved. Laws on notifying customers, regulators, and others vary by location and by the type of data. In the US, every state has its own breach notification law. Under GDPR, notifiable personal data breaches must usually be reported to the supervisory authority within 72 hours of becoming aware of them. A lawyer helps you decide what applies and keeps your investigation privileged where possible.

Who does what

Role	Who in a small company	Responsibilities
Incident lead	Owner or security owner	Makes decisions, keeps the log, approves communication
Technical lead	IT provider, developer, or response firm	Containment, investigation, recovery
Finance contact	Bookkeeper or finance lead	Bank calls, payment holds, checking recent transactions
Communications	Owner or a trusted manager	Messages to staff, clients, and vendors, approved by the lead and lawyer
Outside advisors	Insurer, lawyer	Coverage, legal duties, approved vendors

In a team of five, one person may hold several roles. That's fine. Write the names down anyway.

What not to do

Mistakes that make incidents worse

Wiping or rebuilding machines straight away. It destroys the evidence needed to understand what happened and what data was taken.
Paying a ransom without advice. The FBI and CISA discourage paying ransoms, and payment may raise legal issues. Talk to your insurer, lawyer, and law enforcement first.
Announcing details publicly before you understand the scope and have legal advice.
Using the compromised system to coordinate. Attackers may be reading your email.
Contacting the attacker on your own.
Hiring a response firm before calling your insurer, if you're insured.

After the first hour

Once things are contained:

Find the root cause. How did they get in? A phished password, a missing update, a reused password?
Recover from clean backups, following your disaster recovery plan.
Handle notifications as your lawyer advises.
Hold a short review within two weeks. What worked, what didn't, what changes. Update your plan and policy.

The FTC's data breach response guide is a good, plain-English checklist for the days after.

Practice once a year

Run a 30-minute tabletop exercise: sit down with the people on your contact sheet and walk through a scenario, such as "our bookkeeper's email was used to send fake invoices to clients." Check whether everyone knows their role and whether the phone numbers still work. CISA publishes free tabletop exercise packages you can adapt.

Frequently asked questions

Should we report to law enforcement?

Reporting is generally encouraged. In the US, report cybercrime to the FBI's IC3 and you can also report incidents to CISA. Reporting can help recovery of funds in payment fraud cases and contributes to wider warnings. Your lawyer and insurer can advise on timing.

Is a phishing click an incident?

Treat it as one until you know otherwise. If someone entered a password, reset it and check the account. If nothing was entered and nothing downloaded, it may end there, but log it. Quick reporting should always be welcomed.

How long should the written plan be?

One or two pages: the contact sheet, the roles, and the first-hour steps. Longer plans are hard to use under stress.