When an incident is discovered, the instinct to act fast is natural — but uncoordinated action frequently destroys the very evidence needed to understand what happened.
Resist the urge to wipe and rebuild immediately. Preserve volatile data, isolate affected systems rather than powering them off where possible, and start a simple timeline of what was seen and when.
Communicate through a pre-agreed channel and bring in your response partner early. A calm, documented first hour gives forensic specialists a defensible starting point and can dramatically reduce downtime.
Most importantly, prepare before you need to. A short tabletop exercise today is worth far more than a perfect plan written during a crisis.
