Cyber Incident Response: Contain, Investigate and Recover

During a cyber incident, teams face pressure to restore service quickly. Actions taken in the first minutes can affect whether the attacker remains active and whether useful evidence survives. A short, practiced response plan makes it easier to choose a safe next step.

Prepare before an alert

Write down who can authorize isolation, who owns critical applications and how to contact incident responders if email is unavailable. Keep an offline copy of recovery contacts and the order in which critical services should return. Test access to backups and the administrator accounts needed to restore them.

Contain with the service owner

Confirm the alert and affected systems. Where safe and authorized, isolate a compromised endpoint or segment to limit spread. For systems controlling physical processes or essential services, coordinate containment with the responsible operator so the response does not create a safety hazard.

Preserve timestamps, relevant logs, ransom notes and a concise action timeline. Avoid wiping or rebuilding affected systems before the response team has decided what evidence is needed. Use an independent communication channel if the normal collaboration account may be compromised.

Recover after addressing the entry point

Determine which identities, services and data may have been affected. Revoke exposed credentials, rebuild systems from trusted sources where required, and verify backup integrity before restoring. Bring services back in an agreed order and monitor for repeated access.

Document decisions and unresolved questions as they happen. After service returns, review how the incident started, what delayed detection and whether the recovery procedure worked. NIST's incident response recommendations frame response as part of ongoing cybersecurity risk management rather than an isolated checklist.