PRACTICAL IT RESOURCES
First actions during a cyber incident
Isolate affected systems, preserve evidence, limit impact and organize the response without making the situation worse.
Cybersecurity · Advanced · Immediate
Isolate affected systems, preserve evidence, limit impact and organize the response without making the situation worse.
0/12
Structure the first incident-response actions
Start a shared timeline
Record initial symptoms, time, known scope and response contacts. Coordinate containment and evidence collection with the incident plan and record decisions as work progresses.
Validation example
For a suspected workstation, record its identifier, observations and the agreed containment action. Verify the outcome and investigate other potentially affected systems before considering the scope stable.
Useful evidence
- Dated timeline of observations, decisions and actions.
- References to preserved material, remaining investigation scope and recovery criteria.