What to do in the first 30 minutes of a security incident

A screen showing a ransom demand, files with strange extensions, a customer calling to say they received an odd email sent from your business. The first minutes after you notice a security incident are usually confusing, and decisions made on impulse at that point can increase the damage or wipe out important information. This guide does not replace an incident response plan or the help of specialists, but it sets out what to do while technical support is on its way.

Minutes 0 to 5: stop, breathe and confirm

The first step is to avoid a panicked reaction. Hastily switching everything off, deleting suspicious files or clicking through messages can make the situation worse.

• Confirm what you are seeing: is it a ransom message, inaccessible files, unauthorised access to an account, a suspicious financial transfer? Write down exactly what appeared.
• Photograph the screen with your phone. Ransom messages, alerts and error windows are useful evidence.
• Alert the person your business has designated for this kind of situation. If nobody has been designated, the manager takes charge of coordination until that is sorted out.

Minutes 5 to 15: contain without destroying

The aim now is to stop the problem spreading while preserving whatever can be analysed later.

Isolate, but do not switch off

Disconnect the affected machines from the network: unplug the network cable and turn off Wi-Fi. Avoid switching the computer off, because information held in memory can help explain what happened and is lost when the machine is shut down. If the attack seems to be spreading quickly across the network, the technical team may decide to isolate whole segments or cut the internet connection.

Protect the backup

If a backup disk is connected, disconnect it immediately. If the backup is in the cloud, ask the person responsible to suspend automatic synchronisation until the scope of the incident is understood. Preserved copies are what will make recovery possible; the article on backups against ransomware explains how to prepare them in advance.

Do not delete anything

Encrypted files, phishing emails, logs and ransom messages should be kept. Cleaning everything up may seem to solve the problem, but it removes clues about how the attacker got in and what they accessed.

Minutes 15 to 25: call in the people who need to act

• IT supplier or team: phone them, do not just send an email. If the business email may be compromised, use the phone or an alternative channel.
• Insurer: if the business has cyber insurance, check the policy conditions. Many require prompt notification and recommend firms that specialise in incident response.
• Bank: if financial fraud is suspected, such as a diverted payment or access to online banking, contact the bank immediately.

About the ransom: do not pay or negotiate on impulse. Paying does not guarantee you will get your data back, does not prevent the publication of whatever was copied and may encourage further attacks. Any decision of that kind should be taken later, with technical and legal advice, and never in the first few minutes.

Minutes 25 to 30: record and communicate

Start the timeline

Open a document, preferably outside the affected network, and record: when the problem was noticed, by whom, what was observed, which machines were isolated, who was called and at what time. This timeline will be useful for the technical analysis, for the insurer and for any legal obligations.

Assess whether personal data is involved

Ask straight away: do the affected systems hold data about customers, employees or suppliers who are individuals? Under the UK GDPR, a personal data breach must be reported to the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. If the breach is likely to result in a high risk, the people affected must also be told without undue delay. The EU GDPR sets the same rules, with reports going to the competent national supervisory authority. That is why it is advisable to involve your data protection officer, if you have one, and legal advisers right from the start. The article on cyber security and the UK GDPR explores this relationship in more depth.

Communicate internally

Inform the team clearly and objectively: what is happening, which systems must not be used, through which channel instructions will arrive and whom to report anything unusual to. Avoid speculation and ask that nobody discusses the case outside the business or on social media until there is an official position.

After the first 30 minutes

What comes next depends on the nature of the incident and on technical advice: investigating the cause, cleaning or reinstalling systems, restoring from trusted backups, reviewing access and, where applicable, making formal notifications. Every incident is different, and this guide is meant as a general reference, not a guarantee of any outcome.

Most importantly, these steps should be known before they are needed. A printed sheet with emergency contacts and the first actions, kept somewhere everyone knows, already helps a great deal.

Summary checklist

• Stay calm and photograph what appears on the screen.
• Disconnect affected machines from the network without switching them off.
• Disconnect or protect the backups.
• Do not delete suspicious files, emails or messages.
• Call your IT supplier by phone and, if you have one, your insurer.
• Do not pay or negotiate a ransom on impulse.
• Change passwords from a clean device.
• Record the timeline from the very first minute.
• Check whether personal data is involved and bring in your legal advisers.
• Guide the team with clear messages through a defined channel.