Incident response checklist: the first 72 hours

#First 15 minutes

• Open one incident record; start the timeline (UTC). Everything after this goes in it.
• Assign incident commander and scribe. One person decides; one person writes.
• Contain the obvious: isolate affected hosts, revoke sessions of affected identities, block known indicators.
• Preserve evidence before reimaging: memory where feasible, EDR telemetry, relevant logs.

#First hour

• Scope: hunt for the same indicators and techniques across the estate. Assume lateral movement has started (see breakout time).
• Decide whether this may be a "significant incident" (NIS2) or a personal-data breach (GDPR). If yes, the 24-hour and 72-hour clocks are running.
• Open a separate, out-of-band communication channel in case primary systems are compromised.
• Brief leadership with facts, unknowns and next update time.

#First 24 hours

• Convene the materiality assessment; document inputs and the decision time.
• Engage counsel, insurer and forensic support per policy.
• Eradication plan: credentials to rotate, persistence to remove, patches to apply.

#By 72 hours

• File required notifications from the single timeline.
• Verify containment: hunt again; confirm no new activity.
• Schedule recovery with monitoring heightened on restored systems.
• Book the post-incident review; capture detection gaps as new rules — and test them.