The first hour of a security incident: what leaders should do

When an incident is confirmed, the technical response belongs to specialists. The decisions in the first hour belong to leadership. They are far easier to make when they have been made in advance, in calm conditions.

Contain before you investigate

The instinct is to understand what happened. The priority is to stop it spreading. Disconnecting affected systems, disabling compromised accounts and blocking the route used are decisions your provider should be authorised to take without waiting for a meeting. Agree that authority now.

Preserve the evidence

Do not wipe and rebuild the affected machine before the evidence has been captured. Insurers, regulators and, in some cases, the police will ask what happened. A clean rebuild with no record makes that question unanswerable.

Decide who speaks

One person communicates externally, and everyone else refers to that person. Clients, partners and staff should hear a consistent account. Silence is better than three versions.

Know your notification duties

Depending on where you operate and what data is involved, you may have a legal duty to notify a regulator, your insurer or the people affected within a fixed period. Find out those periods today and write them into the plan.

Insist on the explanation

Once the incident is closed, ask why it succeeded and what has changed so that the same route cannot be used again. A provider who closes the ticket without that explanation has left the door as they found it.

Rehearse it once a year

An hour spent walking through a realistic scenario with your provider will reveal who does not know their role. It is the cheapest security investment you will make.

A practical step: write down, today, the names of the three people who would take the first three decisions. If you cannot, that is the plan's first gap.