Guide · July 23, 2026
What Happens During the First Two Hours of a Cyber Incident?
A decision-focused incident-readiness guide.
Confirm and contain
Use agreed escalation paths. Preserve what is needed for investigation and avoid unapproved changes that could make recovery or evidence harder.
Action checklist
- Confirm the current owner and review date.
- Record the evidence and any limitations.
- Assign the next practical action.
Assign decision owners
Clarify who coordinates technology, leadership, communications, insurers, legal advisers, and your MSP. Avoid assuming a single technical person owns every decision.
Action checklist
- Confirm the current owner and review date.
- Record the evidence and any limitations.
- Assign the next practical action.
Communicate carefully
Use known channels, document material decisions, and avoid public conclusions before facts are verified.
Action checklist
- Confirm the current owner and review date.
- Record the evidence and any limitations.
- Assign the next practical action.
Plan the next operational cycle
Set a rhythm for updates, identify immediate recovery priorities, and determine what specialist help is required.
Action checklist
- Confirm the current owner and review date.
- Record the evidence and any limitations.
- Assign the next practical action.