The First Hour of Incident Response: Do, Don’t, Who to Call

Published October 23, 2026 · Last reviewed October 23, 2026

Before anything: three facts to establish

Stay calm and establish what you know: what was seen (a ransom note, a locked file, a strange payment, a sign-in alert), on which device or account, and at what time. Write it down on paper or on a device that is not part of the affected network. Everything later depends on this record.

Do

Action

Isolate the affected devices from the network. Unplug the network cable or turn off Wi-Fi on the machine. If you cannot disconnect it, power it down to stop the spread, as CISA advises in its ransomware guide.

Why it helps

Ransomware spreads across the network while you decide. Isolation limits the damage.

Verification

The device no longer reaches shared drives or the internet, which you can confirm by trying to open a shared folder.

Fallback if delayed

If you cannot identify the affected machines, ask your IT provider to isolate the whole office network at the router.

Action

Start a log with the time, who noticed, what was seen, who was told and what was done, in order. Keep it on paper or a personal device.

Why it helps

Insurers, counsel, investigators and regulators will ask for the sequence, and memory fades quickly.

Verification

Every entry has a time and a name.

Fallback if delayed

Take photos of ransom notes and error screens with a phone.

Action

Use a separate way to communicate, such as phone calls or a personal messaging app, if you think email or chat is compromised.

Why it helps

An intruder who can read your mail will see your response plan.

Verification

Everyone on the response team has the others’ mobile numbers.

Fallback if delayed

Meet in person.

Action

Preserve evidence. Do not delete files, wipe machines or run clean-up tools until a responder says so. Keep logs and any backup media safe and unplugged.

Why it helps

Wiping destroys the evidence that shows how the intruder got in, and the same route would be used again.

Verification

The affected devices are left switched off or isolated and labelled, not reinstalled.

Fallback if delayed

If the business cannot operate, ask the responder how to preserve a copy before restoring.

Don’t

• Do not pay or negotiate before you have spoken to your insurer, counsel and law enforcement. The FBI does not support paying a ransom, and payment does not guarantee recovery. Payments can also raise legal questions that counsel should answer.
• Do not reset every password from an infected machine. An intruder watching the machine will see the new ones. Change credentials from a known-clean device, on advice.
• Do not use compromised accounts to discuss the incident.
• Do not delete the ransom note or any files the intruder left.
• Do not announce anything publicly or to customers before counsel has reviewed what notification duties apply.

Who to call, in this order

1. Your cyber insurer’s claims hotline. Insurers frequently control who is authorised to respond, and many policies require notice within a stated time. Calling a responder of your own choice first can complicate cover.
2. Your MSP or IT provider, if the insurer’s process allows it. Ask for the most senior person available.
3. Legal counsel, so that notification duties are assessed early. Rules differ between states, provinces and countries, so there is no general answer.
4. Your bank, at once, if money has moved. Ask for a recall, then report the fraud.
5. The national reporting body. In the United States, report to the FBI Internet Crime Complaint Center (IC3). In Canada, report to the Canadian Centre for Cyber Security, and report fraud to the Canadian Anti-Fraud Centre.

How it works

The plan above follows the structure used in public incident-response guidance: detect and record, contain, call the right people, preserve evidence, then recover. The first hour is mostly containment and communication. Recovery is a later phase, and it begins only when responders say the intruder has been removed, which is why restoring from backup at once can bring the attacker straight back. CISA’s ransomware guide and NIST SP 800-61 describe the later phases in detail.

Write the call list now, with names and numbers, and put it where staff can find it without the network: see the one-page incident card. The backup you need most is described in immutable and offline backups. If you have no IT staff, the single most useful action is to unplug the affected computer from the network and phone the insurer’s hotline.

Worked example

A hypothetical 30-person accounting practice finds a locked file server and a ransom note at 8:10 am. The office manager unplugs the server’s network cable, photographs the screen and starts a log at 8:15. At 8:20 she phones the insurer’s hotline from the card by her phone. The insurer opens a claim and names a response firm that will call within the hour. At 8:30 she phones the MSP, then the firm’s lawyer.

She does not restart the server, does not reply to the note, and does not email staff from the office system. By 9:10 the response firm is on the phone with the evidence log and a plan for the next four hours. Times and roles here are invented to show the order of calls.