How Should Businesses Respond To A Cyber-attack? Your Incident Response Questions Answered

When a cyber-attack hits, the first 24 hours are critical. But who makes the first call? What evidence should be preserved? And how do you avoid missteps that could delay your recovery - or your insurance claim? This article answers the most common questions about cyber incident response planning, based on real-world insight from forensic and legal experts.

What's the first thing we should do when a breach is detected?

Start with a triage call. Bring together your IT lead, in-house or external legal counsel, your insurer, and a qualified incident response partner. This should happen within the first hour of discovery. Assign responsibilities early - containment, communications, stakeholder reporting - so nothing gets missed.