The Breach Response Checklist: What to Do in the First 24 Hours

Key takeaways

• The first hour has three jobs: contain, preserve, call. Isolate without powering off, protect volatile evidence, and get the carrier hotline and counsel on the line. Everything else waits.
• Do not touch, reimage, or "clean up" anything before forensics. The single most expensive mistake in incident response is destroying the evidence your insurer and regulator will both ask for.
• The notification clocks start at discovery, not at confirmation. GDPR's 72 hours, HIPAA's 60 days, and state laws all key off when you knew, so start the calendar in hour one.
• One person runs the incident. The incident commander role exists so the person fighting the fire is not also making every decision about it.
• Write everything down with times. The timeline you build in the first 24 hours becomes your notification record, your insurance claim, and your post-incident review.

Hour zero to one: contain, preserve, call

Contain:

• [ ] Isolate affected systems at the network level: disconnect segments, disable accounts, block the C2 destinations if you have them
• [ ] Do NOT power off encrypted or compromised machines if you can isolate instead; volatile memory is evidence
• [ ] Do NOT restore from backup yet; that destroys the evidence of what happened and what left
• [ ] Snapshot cloud workloads and cluster state where your platform allows it; cloud evidence evaporates

Preserve:

• [ ] Log the discovery time and who discovered it, to the minute
• [ ] Start an incident log; every action, decision, and time goes in it
• [ ] Begin evidence collection to a defensible standard, or make it the responder's first task

Call, in this order:

• [ ] The breach hotline on your cyber policy, if you carry one; panel rules and reimbursement depend on this call (what panels change)
• [ ] Counsel; response work runs under privilege when counsel directs it
• [ ] Your retainer firm, if you have one, or begin the responder selection

Hours one to four: scope and command

• [ ] Name an incident commander and give them the authority to spend and decide
• [ ] Establish the communication channel for the incident (out of band if email may be compromised) and who speaks for the organization
• [ ] Begin scoping: what systems, what data, what credentials, what third parties
• [ ] Preserve business-critical services: the goal is containment that keeps the organization running, not a security theater shutdown

Hours four to twenty-four: the clocks and the response

• [ ] Notify the board or leadership with a factual first briefing: what is known, what is not, what happens next
• [ ] Start the notification matrix from your response plan: GDPR 72 hours, HIPAA 60 days, state breach laws with their own deadlines, contractual notice clauses, and public-company disclosure if listed
• [ ] Check your carrier panel status before engaging any firm not on it, and get pre-approval in writing if you go off-panel
• [ ] If ransomware is involved: do not make the payment decision in hour six, the response sequencing and the negotiation guide exist for that decision
• [ ] Decide your external communications posture early; silence is a statement, and crisis communications firms sit on many carrier-published panels

What not to do, at any hour

• Do not reimage, reset, or "clean" before forensics. Every restoration is evidence destruction.
• Do not delete the attacker's files or ransom notes. They carry version and timeline data responders use.
• Do not engage the attacker directly from your own email. That is what professional negotiation and counsel are for.
• Do not promise stakeholders a scope you have not confirmed. "We are investigating and will update" survives; "only 3 systems" does not.

The day after

The incident is now managed or it is managing you. If it is managed: keep the log, keep the evidence chain, and start the post-incident review that turns this incident into an organizational asset. If the incident found you without a plan, the response plan template and a tabletop exercise are how the next one starts from this checklist instead of from panic.

Frequently asked questions

What is the first thing to do in a data breach? Contain without destroying evidence: isolate at the network level, do not power off or reimage, log the discovery time, then call your carrier's breach hotline and counsel. The order matters because panel rules and privilege both depend on those calls happening early.

When do breach notification clocks start? At discovery, not confirmation. GDPR allows 72 hours from awareness, HIPAA 60 days, and several US states add their own deadlines on top, so the clock starts in hour one of this checklist.

Should we call our cyber insurance carrier first or a response firm? The carrier, if you carry cyber insurance. Their panel rules determine who gets paid and how much, and panel firms can usually start billing against the claim immediately. Going off-panel without the pre-approval call is the most expensive sequencing mistake buyers make.

Who should run the incident response? One named incident commander with decision authority, whether internal or the engagement lead from your response firm. The commander role keeps the person fighting the fire from also being the person making every call.