Stabilise authority and preserve options
Name the incident leader, technical authority and business decision-makers. Use protected communication and record actions. Isolate affected systems or identities where authorised and safe, but avoid uncontrolled shutdowns that destroy volatile evidence or interrupt services without a recovery plan.
Engage legal advisers, insurers, law enforcement or specialist responders according to applicable obligations and contracts. Separate confirmed facts from hypotheses. Payment and notification decisions require qualified advice and should not be improvised by the technical team.
Establish a trustworthy recovery boundary
Assume production identity, administration tools and deployment paths may be affected until evidence supports confidence. Create a controlled recovery environment with known-good accounts, devices and network paths. Protect backups from the credentials and automation used in production.
Prioritise services by business dependence and recovery prerequisites. Restore identity, keys, network services, configuration and data in an order that supports usable operations. Scan or rebuild components and correct the exploited path before reconnection. A restored server is not necessarily a trustworthy service.
Validate, monitor and improve
Test integrity, access, logging and business function before returning a service. Increase monitoring for renewed access and persistence. Keep recovery evidence and decision records so leadership can understand remaining uncertainty and residual exposure.
After stabilisation, identify control and coordination gaps without reducing the event to one user or missed patch. Re-test backups, isolation, emergency identity and rebuild procedures. Fund changes that reduce time to contain and recover, then exercise the revised path.
What to do next.
- ✓Establish protected leadership and communications.
- ✓Preserve evidence before destructive action.
- ✓Create a known-good recovery environment.
- ✓Restore services in dependency order.
- ✓Remove the attack path before reconnection.
- ✓Re-test recovery and containment improvements.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.