01Name a decision owner and get qualified help
Use the incident response plan if one exists. Identify the person coordinating the response, the IT contact who can act on systems and the business owner who can approve disruption. A small business may rely on a managed service provider rather than an internal security team. Make the responsibility explicit instead of assuming someone else is handling it.
Bring in qualified incident response help when the scope or technical steps are uncertain. Check whether an insurance policy requires a particular notification or provider before commissioning work. Legal, contractual and reporting obligations depend on the business and location; this guide is a preparation aid, not legal advice or a substitute for professional response.
02Create a factual timeline
Record what was observed, when it was observed, which account or device was involved and who reported it. Separate confirmed facts from assumptions. An alert that says a login was suspicious is not yet proof that all company data was stolen. Equally, the absence of visible damage does not prove the event is harmless.
Preserve relevant alerts, original emails, available logs and records of actions taken. Store them somewhere the suspected attacker cannot readily alter. Avoid deleting messages, clearing logs or reinstalling affected devices simply to make the warning disappear. Qualified responders may need information that those actions would destroy.
03Contain deliberately, not mechanically
Containment can include isolating an affected endpoint, disabling an account or revoking sessions. The correct action depends on what is happening and which systems are involved. Active destructive behavior may require rapid containment, while an uncertain alert may need additional assessment. Coordinate the decision with the people responsible for the system.
Do not treat powering off every device as a universal first step. Shutdown can lose volatile evidence, and disconnecting systems can interrupt critical operations. A responder should balance ongoing harm, safety, business impact and evidence preservation. Do not delay necessary action during an active attack merely to collect perfect evidence, but document the decision and its reason.
04Keep communications trustworthy
If company email or chat may be compromised, coordinate through an agreed alternative channel. Keep a shared incident record with access limited to the people who need it. Tell employees where to report new symptoms and which actions they should avoid, rather than allowing several conflicting instructions to circulate.
Let the designated owner coordinate customer, vendor and regulatory communications with appropriate advice. Do not speculate publicly about the cause, scope or recovery time. A short statement of confirmed facts and the next update is more useful than a confident promise that later proves wrong.
05Prepare before the first hour arrives
Keep an accessible contact list, know who can disable accounts and identify where important logs and backups are held. Rehearse a fictional compromised-mailbox scenario: who gets called, who makes the containment decision and how the team communicates if email cannot be trusted? After the exercise, fix missing contacts and unclear authority. Readiness comes from testing these decisions before the pressure is real.
Sources & further reading
NIST SP 800-61 Rev. 3 — Incident Response Recommendations
NIST SP 800-86 — Integrating Forensic Techniques into Incident Response