Skip to content

Guides

First hours after a cyber incident: a checklist

Prioritize containment, clear coordination and evidence preservation during the first hours.

How we can help

  • Assign an incident lead and record detection time.
  • Identify affected systems and coordinate containment.
  • Preserve logs before irreversible changes.
  • Assess personal-data notification obligations.

Service limitations

  • Avoid wiping devices without review.
  • Responses should reflect the actual incident and risk.

Services →

Need help with this situation?

Talk to a specialist on Telegram. The initial review is discreet.

Telegram is an initial contact channel. Please don't send passwords or highly sensitive documents in the chat.

More guides