A suspicious login, an encrypted file, and a fraudulent payment need different technical actions. They share one early requirement: somebody must coordinate the response and know who has authority to make the next decision.
Name the people behind the incident decisions
Technical actions and business authority need a coordinated response.
Employees should not have to diagnose an attack before asking for help. Give them a known reporting route and a fallback phone number. Ask them to explain what they observed, when it happened, and what they already did. Early reporting is more valuable than a perfectly written ticket.
Protect people and contain the problem
Follow the organization's response plan. For a suspected affected computer, the technical team may direct network isolation while preserving the device for investigation. CISA's ransomware response guidance favors isolation where possible and recognizes that powering down can lose evidence held in memory. If safe isolation cannot be achieved, the responder must weigh the available options.
Do not start deleting files, running cleanup utilities, or reinstalling systems simply to make a warning disappear. Preserve the original message, alert, or ransom note. Avoid moving potentially malicious attachments through ordinary staff email.
Operational systems need particular care. Disconnecting a device that supports safety, access control, or essential services can have consequences beyond the screen. The incident lead should coordinate with the person responsible for that operation and the relevant provider.
Use a channel the attacker does not control
If email access may be compromised, use a verified alternative for response coordination. A compromised mailbox is a poor place to discuss the investigation or send new credentials. Keep an accessible contact list for management, IT, the insurer, specialist responders, and key suppliers.
If a fraudulent transfer has occurred, contact the financial institution immediately. The FBI's business email compromise guidance also directs victims to report to IC3. Do not delay that call while completing an internal report, and do not promise that funds will be recovered.
Assign business decisions separately from technical tasks. Someone must decide which work pauses, what fallback is authorized, and who communicates with staff and customers. Our incident response guide helps make those handoffs explicit.
Recover after understanding the exposure
Account recovery may involve blocking access, revoking sessions, reviewing application grants, and changing credentials from a suitable clean device. A password change alone should not be treated as proof that access has ended. The scope depends on what was compromised.
Legal and records personnel should determine applicable reporting and notification duties from the facts. A familiar deadline from another industry or jurisdiction is not a reliable rule for every incident. Record decisions, known facts, and uncertainties as the investigation develops.
Use the recovery plan to restore in a controlled sequence and have business users verify the result. Returning systems before removing the cause can reopen the same problem.
Afterward, review the response without blaming the person who reported it. Improve the continuity arrangements, permissions, monitoring, and contact information that proved inadequate. Assign the unfinished work before closing the incident, and check that staff know where to find the revised instructions.