First 24 hours after a breach

What the first 24 hours are for

Audience: the incident commander and the leadership, counsel, and insurer already looped in during hour one. The first hour scoped systems, decided contain-versus-observe, and started a timeline. The first 24 hours finish short-term containment, hold the evidence, onboard DFIR if you need it, decide who inside the organization is told, and list which reporting clocks might already be running. Customer and regulator notice as a campaign still belong later unless counsel says a clock has started.

NIST SP 800-61r2 is still in containment here, not eradication. The SANS PICERL model does not jump to recovery because the business wants the lights back. If hour one is unfinished — no timeline, no contain-versus-observe call, counsel unpaged — do that first. This page assumes those moves have started.

• Keep the UTC timeline. Every new fact, action, and decision is a new line, not an edit.
• Place an evidence hold: logs, hosts, mailboxes, cloud trails. Do not rotate, reimage, or tidy.
• Finish short-term containment. Long-term containment and eradication wait for a forensic image and a plan.
• Onboard DFIR if you do not have in-house capture. Give them the timeline and the hold list, not a rebuilt estate.
• Map which reporting clocks may have started. Mapping is not filing. Counsel decides applicability.
• Decide who is informed internally. Default is need-to-know. Public posts still tip the actor.

Continue the timeline

A 24-hour timeline is the artifact later people will argue from: counsel, the insurer, DFIR, a regulator, you. SANS treats contemporaneous notes as part of identification. NIST SP 800-61r2's evidence-handling guidance is acquire, preserve, secure, and document. A reconstructed narrative written next week is a different document from the notes you took while it happened.

• UTC. Time zone conversions after the fact are how two logs disagree.
• Each line: time, observer, system or account, what was seen, what was done, who authorised it.
• Add: when DFIR was retained, when the evidence hold was issued and to whom, when leadership was briefed, and the current contain-versus-observe state.
• Record unknowns as unknowns. 'Not yet scoped: backup accounts' is a fact. Deleting the gap so the timeline looks complete is not.
• Corrections are new lines. Do not silently rewrite an earlier entry.

Evidence hold

An evidence hold is an instruction, not a feeling. The people who can rotate logs, reimage hosts, empty mailboxes, or expire cloud trails need to hear — in writing — that they must not. The FTC Data Breach Response guide is explicit: do not destroy forensic evidence during investigation and remediation. NIST SP 800-61r2: acquire, preserve, secure, and document. CISA's ransomware guidance treats power-off and rebuild as last resorts because they destroy volatile evidence.

• Hosts already isolated: leave powered on until memory and disk are captured, or until DFIR says otherwise.
• Logs that rotate (EDR, identity, cloud audit, mail, VPN, WAF, CI). Extend retention now; do not wait for a ticket next week.
• Identity artifacts: session lists, MFA enrollments, API keys, SSO audit. Capture before mass password reset from a compromised plane.
• Backups and snapshots: preserve the copies that existed at detection. Do not 'refresh' them from a dirty primary.
• Tell IT, cloud admins, and whoever owns SaaS admin that deletion, reimage, and tidy-up are suspended. Name a person they can call.
• Chain of custody is a log of who touched which artifact, when, and why. You do not need a courtroom form on day one; you need an unbroken note.

Who is informed

Need-to-know is the default for the first 24 hours. CISA warns that actors monitor response activity and will move if they know they have been found. A public status page, an all-hands email, or an in-band 'we see you' message is how you tell them. NIST SP 800-61r2 expects appropriate internal parties to be notified as the incident is handled — not the whole company, and not the internet, unless your plan and counsel say so.

Notification clock awareness — not a determination

Some legal regimes start an early-warning clock measured in hours from when you become aware. Others give days or 'without unreasonable delay'. Mapping which clocks might apply is first-24-hours work. Deciding that one applies, and filing, is counsel's work on your facts. This page is jurisdiction-agnostic operational guidance. It is not legal advice. Last verified 7 September 2026 against the sources below; if a later revision of a source changes a deadline, the date is how you can see we have not re-checked yet.

Do not treat 'we are not sure it is a breach' as a reason to skip the map. NIST SP 800-61r2 starts handling at detection, not at legal certainty. The map is a list of questions for counsel, not a filing.

DFIR engagement in the first 24 hours

If you cannot capture memory and disk yourself, the first 24 hours is when a DFIR firm should already be on the way, not when you start shopping. Insurers often require you to use a panel firm and to notice them first — check the policy. A dedicated 'when you need DFIR' guide is not on this site yet. Until it is, this is the hour-to-day-one checklist.

• Page the retained firm, or ask counsel and the insurer which panel firm to call. Do not wait for complete scope.
• Hand them the UTC timeline, the scope list (including unknowns), the contain-versus-observe decision, and the evidence-hold list.
• Do not rebuild, reimage, or mass-rotate before they say what they need imaged. NIST and SANS put eradication after identification and containment.
• Keep the out-of-band bridge. Do not add the firm to a possibly compromised identity plane as their only path in.
• One internal owner for the firm (usually the commander or counsel). Split instructions are how two images get taken and neither is complete.

Where this shows up in ShipReady Metrics

The signed-in app does not run this 24-hour plan, hold your evidence, or file a notice. If you already have a session: signed-in app → Compliance → CRA reporting tracks the 24-hour / 72-hour / 14-day ladder from your recorded awareness. It does not start a clock for you, and it is not a determination that CRA applies. A named human still submits. The cyber risk register lives under Security; the obligation map (frameworks you have marked in-scope) is under Compliance. None of those surfaces preserve volatile evidence or notify a regulator.

Primary sources (last verified 7 September 2026)

Every operational and regulatory claim on this page is taken from one of these. If a later revision of a source changes the advice, the date above is how you can see we have not re-checked yet.

Regulation (EU) 2024/2847 Article 14 is a legal requirement only when CRA applies to you. ENISA's Single Reporting Platform materials describe the filing path; they do not decide that you are in scope. NIST SP 800-61 Revision 2 remains the current final Computer Security Incident Handling Guide (August 2012) — guidance, not a statute. CISA's playbooks are operational procedures written for US federal civilian executive branch information systems. The SANS handbook is a practitioner checklist. The FTC guide is business guidance from a US regulator; the legal notification duties are in the statutes it points at, not in the guide itself.

Frequently asked questions