Checklist · Operations

Security incident: the first hour

A short list to work from while pressure is high. It does not replace your incident response plan.

Owner: Incident leadTime: 60 minISO 27001 A.5.24ISO 27001 A.5.26ISO 27001 A.5.27ISO 27001 A.8.15

0 of 21

First 10 minutes

Name an incident lead and open one channel and one record; all updates go there.
Write down what was seen, by whom and when, with timestamps in UTC.
Set a provisional severity; raise it later, never wait to start.
Page the people the severity requires, including the on-call for the affected system.
Start a log of every action taken and every decision, with the time.

Contain

Isolate affected hosts from the network instead of powering them off, so memory and logs survive.
Disable or reset compromised accounts and revoke their sessions and tokens.
Block known malicious addresses, domains and hashes at the edge and in endpoint tooling.
Rotate secrets that the affected system could read, starting with the most powerful.
Prefer containment that is reversible, and note anything you changed.

Preserve evidence

Take snapshots or disk images of affected systems before cleaning up.
Export relevant logs (authentication, network, cloud audit) to a protected location.
Record who handled each piece of evidence and when (chain of custody).
Do not log in to affected machines with personal or domain-admin accounts.

Communicate

Brief management with facts, impact so far, what is unknown and when the next update will be.
Involve legal and the data protection officer if personal data may be affected; the regulator clock may already be running.
Check contracts and regulations for notification deadlines (for example 72 hours under GDPR, and NIS2 early warnings).
Agree one spokesperson. Do not discuss the incident on public or personal channels.

Before you hand over

Current status, open actions and owners are written down for the next shift.
Scope is re-assessed: what else did the same account, host or credential touch?
A review is scheduled within a week to record root cause and the fixes.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Ready to move
beyond legacy GRC?

14-day free trial. No credit card. Cloud or on-premises.

Request demo Talk to sales →