Incident detected. Plan kicks in.

1. 1

   Receive and review the report

   Reports come in through fixed, trusted channels (DER.2.1.A9), including from third parties (NIST RS.MA-02). Briefly check whether a security incident has actually occurred and estimate severity and urgency (NIST RS.MA-02).

2. 2

   Declare the incident, appoint a lead

   If the defined criteria are met, declare the incident and appoint a responsible person; if needed, call in the IR service provider and trigger other plans such as the contingency plan (NIST DE.AE-08, RS.MA-01).

3. 3

   Classify and prioritize

   Determine the type of incident, such as data exfiltration, ransomware, account takeover or service outage, and classify and prioritize it using a consistent method (NIST RS.MA-03, DER.2.1.A11).

4. 4

   Log and secure evidence

   Record every finding and action with a timestamp, keep records confidential and unaltered; secure data that can explain the type and cause (NIST RS.AN-06, RS.AN-07; DER.2.1.A6, A16).

5. 5

   Contain

   Isolate affected systems and network segments, block unauthorized access, change passwords, keys and service accounts if compromise is suspected, revoke privileged access (CISA playbook, Containment). Weigh the impact on operations and on evidence preservation.

6. 6

   Determine extent and cause

   Reconstruct the sequence of events, identify vulnerabilities and attack paths, and search for traces and backdoors even on systems that are not obviously affected (NIST RS.AN-03, RS.AN-08). New traces expand the analysis and containment (CISA playbook).

7. 7

   Eradicate

   Identify all affected systems and services, remove malware, disable compromised accounts, close exploited vulnerabilities (NIST RS.MI-02); have the head of IT operations approve the measures beforehand (DER.2.1.A5).

8. 8

   Recover and confirm

   Check backups for integrity before use (NIST RC.RP-03), restore systems with all patches, change all credentials, involve users in functional tests and then monitor closely (DER.2.1.A6). Declare the end of the incident based on criteria (NIST RC.RP-06).

Do not tip off the attacker: CISA advises informing affected parties by phone rather than email, using a channel outside the potentially compromised systems for coordination and not uploading malware samples to public analysis services.