Incident response
Vendor-neutral first-response guidance for founders, CTOs, CISOs, and incident commanders — grounded in CISA, NIST SP 800-61r2, SANS, and the FTC. Not legal advice.
We've been breached — what do we do now?
First moves after a cyber incident: isolate, preserve evidence, name a commander. Do not reimage, delete logs, or tip the actor. CISA, NIST, SANS, FTC.
First 15 minutes after a cybersecurity incident
A single-screen checklist for the first 15 minutes of a cyber incident: declare, name a commander, preserve volatile evidence, and do not power down or reimage yet.
First hour after a breach
First-hour runbook after a breach: scope systems and accounts, decide contain versus observe, engage leadership, legal, insurer, and begin a UTC timeline. Not legal advice.
First 24 hours after a breach
First 24 hours after a data breach: keep the timeline, hold evidence, map which reporting clocks may have started, and decide who is informed. Not legal advice.
First 72 hours after a breach
First 72 hours after a breach: map GDPR Article 33 and CRA Article 14 clocks that may apply, document facts, and decide who to notify. Not legal advice.
First week after a breach
First week after a breach: validate recovery, plan individual notice, start the CRA 14-day final-report window, and hand off to post-incident review. Not legal advice.
Who should you call after a cybersecurity breach?
Who to call after a breach: commander, legal, exec, comms internally; then insurer, counsel, DFIR, law enforcement, regulators. Decision tree, not a ranking. Not legal advice.
When should you contact cyber insurance?
When to notify a cyber insurer after a breach: prompt-notice clauses, panel vendors, and what the carrier will ask. Verify YOUR policy. Not legal or coverage advice.
When should you contact outside breach counsel?
When to contact outside breach counsel after a breach: privilege, counsel-directed DFIR, and who maps regulator notice. Common practice, not a ruling. Not legal advice.
What is digital forensics and incident response?
What DFIR is: identify, preserve, analyze, and report. Forensic soundness, chain of custody, and how digital forensics sits inside incident response. Not legal advice.
When do you need a DFIR firm?
When to hire a DFIR firm: in-house vs external decision tree, insurer-panel constraints, and stated selection criteria. Not a ranking. Not legal advice.
What evidence should you preserve after a breach?
What to preserve after a breach, in order: memory, disk images, logs, and chain of custody. RFC 3227 teaching sequence, not a statute. Not legal advice.
What should you never delete or reimage after a breach?
Do not power down, reimage, rotate logs, purge mailboxes, or clean up malware after a breach. Isolate, do not destroy. RFC 3227, NIST SP 800-86. Not legal advice.
How do you determine whether data was actually stolen?
How to tell if data was stolen: egress logs, cloud access, staging artifacts, DLP. Access is not exfiltration. Counsel maps notice. Not legal advice.
Compromise vs access vs exfiltration vs confirmed data breach
Four terms: compromise, access, exfiltration, confirmed data breach. GDPR Article 4(12) is an EU legal definition, not a universal English word. Not legal advice.
How to build an incident timeline
Build a UTC incident timeline: template, timezone and clock-skew notes, dwell and discovery markers, evidence IDs. NIST and SANS guidance. Not legal advice.
Post-incident review checklist
Post-incident review checklist: lessons, what failed, and corrective actions with owners and due dates. ISO and SOC programs expect documented lessons. Not legal advice.
How to perform root cause analysis after a security incident
Blameless RCA after a security incident: proximate vs root cause, contributing factors, and corrective actions with owners. NIST and CISA guidance. Not legal advice.
How to document containment and recovery actions
Record who, what, when, why, and evidence for every containment, eradication, and recovery action. Confirm eradication before restore. Not legal advice.
Ransomware response checklist
Isolate ransomware hosts without wiping evidence. Assess backups. Treat payment as a counsel, insurer, and OFAC risk question — not a recommendation. Not legal advice.
Credential compromise response checklist
Revoke sessions and tokens, rotate credentials, enforce MFA, then hunt OAuth grants, mail rules, and new keys after leaked or phished credentials. Not legal advice.
Cloud account compromise response checklist
Preserve cloud logs first — they roll off. Hunt IAM persistence, new resources, cryptomining, and staging. Rotate keys and evict the actor. Not legal advice.
Repository compromise response checklist
Audit access, tokens, and deploy keys. Hunt planted commits and workflow changes. Rotate secrets in history and ask if a release was poisoned. Not legal advice.
CI/CD pipeline compromise response checklist
Freeze poisoned pipelines. Audit runners, workflows, and secrets. Rotate signing keys and pipeline credentials. Verify artifact provenance. Not legal advice.
Supply-chain incident response checklist
Confirm exposure from a vendor or dependency breach, map the blast radius, and walk contractual versus DORA and CRA flow-down duties with counsel. Not legal advice.
What are the best incident response firms?
Major IR providers by stated criteria: public IR offering, retainer, jurisdiction, CREST/PFI class. Not a ranking. Inclusion is not endorsement. Not legal advice.
Best digital forensics firms — criteria, not a ranking
Vendor-neutral landscape of digital-forensics firms by stated criteria: PFI, CREST, ISO/IEC 17025, jurisdiction, media/cloud/mobile scope. Not a ranking. Not legal advice.
How to select a DFIR provider
How to select a DFIR provider: decision tree, stated criteria (accreditation class, panel, jurisdiction, scope), and red flags. Not a ranking. Not legal advice.
How do DFIR firms preserve chain of custody?
How DFIR firms keep a chain of custody: chronological record, transfer log, hashes, working copy. NIST SP 800-86, ISO/IEC 27037, RFC 3227. Not legal advice.
What is an incident response retainer?
What an IR retainer is, how it differs from on-demand engagement, and typical terms (hours, panel, notice). Generic, not YOUR policy. Not legal or coverage advice.
Should you have an incident response retainer before a breach?
Should you buy an IR retainer before a breach? Decision tree by size, data, regulation, and insurance — retainer vs on-demand. Not legal or coverage advice.
Questions to ask an incident response provider
Questions to ask an IR provider: accreditation (PFI, CREST, FedRAMP), SLA, data handling, jurisdiction, tooling, deliverables, cost. Not a ranking. Not legal advice.
What does a breach investigation cost?
How much does a breach investigation cost? DFIR vs IBM total-breach averages vs GDPR/CRA penalties. Cost drivers and ranges with sources. Not legal or financial advice.
What information should you give a DFIR firm?
What to hand a DFIR firm: assets, logs, access, timeline, architecture. Do not wipe, rebuild, or patch first. Intake checklist. Not legal advice.
How do major incident response providers compare?
Side-by-side comparison of major IR providers by stated criteria: parent, CREST/PFI class, FIRST membership, public scope, retainer. Not a ranking. Not legal advice.