Responding to a Cyber Incident: The First 72 Hours

When an organization discovers suspicious activity on its systems, the pressure to restore operations quickly is intense. The decisions made in the first few days, however, determine whether the facts can be established later and how well the organization is positioned legally.

Contain without destroying evidence

Isolate affected systems from the network rather than wiping or rebuilding them immediately. Reimaging a compromised server may stop the attack, but it can also erase the logs and artifacts needed to understand what happened.

Preserve logs and images

Secure firewall, VPN, authentication, email and endpoint logs before retention settings roll them over. Where feasible, capture forensic images of key systems and memory.

Involve counsel early

Engaging counsel at the outset helps structure the investigation, coordinate outside experts and manage communications. Depending on how the work is structured and the jurisdiction, some investigative work may be protected by privilege, although courts examine those claims closely.

Understand notification obligations

Every U.S. state and the District of Columbia has a data breach notification law, and sector-specific rules may also apply. Deadlines and triggers vary, so determining what data was affected and where affected individuals live is a priority.

Document decisions

Keep a contemporaneous record of what was discovered, when, and what actions were taken. That timeline will be essential for regulators, insurers, and any later dispute.