An incident rarely arrives with a complete explanation. It may begin with inaccessible files, an unusual payment, repeated sign-in prompts, a supplier warning or a message from an attacker. The first objective is not to solve everything immediately. It is to move from confusion to controlled response.
First hour: establish command
Activate the incident lead and open an out-of-band communication channel in case email or collaboration systems are affected. Record the time, initial symptoms, systems involved and people making decisions.
Contact the organization's approved IT/security response provider. If cyber insurance may apply, review the notification and consent requirements before retaining unfamiliar external services. Preserve suspicious messages, screenshots, alerts and timelines.
Do not delete evidence, wipe devices or negotiate with an attacker without qualified guidance.
Hours 1–4: contain without destroying evidence
Isolate affected devices or accounts based on technical advice. Disable confirmed compromised sessions, tokens or credentials. Protect administrator accounts and recovery systems. Determine whether the incident is still active and whether other systems show related indicators.
Containment should be proportionate. Shutting down everything may interrupt the business and destroy useful context; leaving everything connected may increase damage. The response lead and technical lead should make and document this decision together.
Hours 4–8: determine the business impact
Identify which services are unavailable, which information may be affected and which business processes are at risk. Establish restoration priorities based on operational need, not convenience.
Begin a structured privacy and legal assessment. Under PIPEDA, organizations subject to the law may have reporting and notification obligations where a breach of security safeguards creates a real risk of significant harm. Applicability and legal interpretation require qualified advice.
Hours 8–16: communicate with discipline
Prepare one approved internal update covering what is known, what remains unknown, what employees must do and where new information should be reported. Avoid speculation.
Decide whether clients, vendors, regulators, law enforcement or other parties must be contacted. Communications should be accurate, coordinated and reviewed by the appropriate legal/privacy adviser.
Hours 16–24: move toward safe recovery
Validate clean backups and define recovery order. Confirm that the initial access path has been addressed before reconnecting restored systems. Reset credentials and strengthen controls according to the evidence, not through an uncontrolled blanket change.
At the end of the first day, leadership should have a current situation summary, known business impact, containment status, evidence log, communication decisions, recovery priorities and a plan for the next operational period.