Cyber attacks rarely happen at a convenient time. Someone notices files with strange names on the shared drive on a Friday evening. A customer calls to say they received an invoice from you with new bank details. The accounts laptop shows a ransom note. What happens in the next hour decides how bad the next month will be.
Large companies have incident response teams. Most small and mid-sized businesses have a few people, a lot of stress and no plan. This post gives you a simple plan for the first 60 minutes. Write your version now, print it, and keep a copy somewhere that doesn’t depend on your computers working.
Before anything happens: four things to decide
- Who can declare an incident. One named person, plus a deputy. When they say “this is an incident”, the plan starts.
- Who to call. Your IT team or provider, your security partner, your cyber insurer’s incident hotline, your bank, and the owner or managing director, with mobile numbers written down, not just stored in e-mail.
- How you’ll talk if e-mail is down or being read. Agree a backup channel, such as a phone tree or a WhatsApp group on personal phones.
- What matters most. A short list of the systems the business can’t run without, in order, so recovery effort goes to the right place first.
Minutes 0 to 10: stop, declare, call
- Declare the incident. Don’t wait to be sure. It is much cheaper to stand down a false alarm than to lose an hour.
- Start a log. Note the time, what was seen, by whom, and every action from now on. Investigators, insurers and regulators will all ask for this.
- Call your insurer’s hotline early, if you have cyber insurance. Many policies require you to notify them quickly and to use their approved responders. Hiring someone else first can affect your cover.
- Call your IT and security partners and tell them what you know so far.
- If money has been paid to a fraudster, call the bank now to recall or freeze it. In India, also call the cybercrime helpline on 1930.
Minutes 10 to 30: contain without destroying evidence
- Isolate, don’t switch off. Disconnect affected computers from the network (unplug the cable, turn off Wi-Fi), but leave them powered on unless your responder says otherwise. Memory holds evidence that disappears when a machine is shut down.
- If ransomware is spreading, disconnecting the internet connection or shared servers can stop it reaching more machines.
- Lock compromised accounts. Reset the passwords of affected accounts from a clean device, sign them out of all sessions, and remove any e-mail forwarding rules or app permissions the attacker added.
- Protect your backups. Disconnect backup drives and check that cloud backups can’t be deleted by an account the attacker might control. Backups are often the attacker’s next target.
- Don’t wipe, rebuild or restore yet. Until you know how they got in, you risk restoring straight back into the same hole.
Minutes 30 to 60: understand and communicate
- Size it up. Which systems and accounts are affected? Is personal data involved: customers’, employees’, patients’? Is the attacker still active?
- Keep the business running. Switch critical work to manual processes or unaffected systems. Decide what to tell customers who are waiting.
- One voice. Choose one spokesperson. Tell staff what to say if asked (nothing yet, pass it to the spokesperson) and not to post about it on social media.
- Don’t discuss it on a mailbox the attacker might be reading. Use the backup channel you agreed.
The clocks that start ticking
Reporting deadlines often start from the moment you become aware of an incident, so check which ones apply to you in the first hour:
| Where | Rule | Deadline |
|---|---|---|
| India | CERT-In directions for reportable cyber incidents | Within 6 hours of noticing |
| India | DPDP Act personal data breach (duties apply from May 2027) | Without delay; detailed report to the Board within 72 hours |
| India | Sector regulators (RBI, SEBI, IRDAI) for regulated entities | Their own, often short, timelines |
| US | State data breach notification laws | Varies by state |
| US | SEC rule for listed companies (material incidents) | 4 business days after deciding it is material |
| US | FTC Safeguards Rule (financial-type businesses, 500+ people affected) | Within 30 days of discovery |
| Anywhere | Your cyber insurance policy and customer contracts | Check the notification clause |
What not to do
- Don’t pay a ransom, or contact the attacker, without expert and legal advice.
- Don’t delete logs, e-mails or files “to clean up”.
- Don’t restore from backup before you know how the attacker got in.
- Don’t announce anything publicly until you know the facts, and then say only what you know.
Your one-page plan
Copy this into a document, fill it in and print it:
- Incident lead and deputy: names and mobile numbers.
- Call list: IT, security partner, insurer hotline (policy number), bank, legal adviser, management.
- Backup communication channel: how and where.
- Critical systems, in order: what the business needs first.
- Where the backups are and who can restore them.
- Reporting deadlines that apply to us: CERT-In, DPDP, regulators, US states, contracts.
- Spokesperson and a two-line holding statement.
- After the first hour: who leads the investigation, recovery and lessons learned.
Then test it: a one-hour tabletop exercise once a year, walking through a scenario such as “the accounts mailbox has been hacked”, will show you what’s missing.
How CATEYE can help
Our IT security strategy work includes response management, incident response and digital forensics: we help you write the plan, test it, and stand beside you if the worst happens. If you don’t have a senior security person, our virtual CISO can own the plan for you. Talk to us before you need us.
