Stage Three of Cyber Resilience: What to Do After a Breach
Last week, we looked at how organizations get breached. This week, as Cybersecurity Awareness Month continues, we turn to the moment every leader hopes never comes: the phone call, the strange login alert, or the screen nobody recognizes. Something has happened. Stage 3 of cyber resilience is what to do after a breach.
What you do next matters more than almost anything you did before. The first 24 hours after a cyber incident shape how much damage is done, how quickly you recover and how much trust you keep with employees, customers, and partners.
The good news is that those hours do not have to be chaos. With a clear plan, they become a sequence of deliberate steps. Here is how to think about them.
The first 24 hours, in three phases
Hours 0 to 4: Stabilize
The instinct in the first few minutes is to do something, fast. Resist the urge to act before you understand what is going on.
- Activate your incident response team. Bring together IT, leadership, legal and your outside security partner right away. A breach is not just an IT problem, and it should not be managed like one.
- Preserve evidence. Logs, affected devices and suspicious emails are critical to understanding what happened. Do not wipe, rebuild or “clean up” anything yet.
- Assess the scope. Which systems, accounts and data are involved? What is still working? The answers will drive every decision that follows.
Hours 4 to 12: Contain
Once you have a picture of what is affected, the priority shifts to stopping the spread.
- Isolate affected systems. Disconnect compromised machines from the network rather than shutting them down, so evidence is preserved.
- Disable compromised accounts. Lock out any user or service accounts the attacker may control.
- Rotate credentials. Reset passwords and keys, starting with administrator and privileged accounts, then work outward.
Containment is a balancing act. Move quickly enough to limit the damage, but carefully enough that you do not tip off an attacker who may still be inside or destroy the evidence your investigation depends on.
Hours 12 to 24: Communicate
By now, people inside and outside your organization know something is wrong. Silence breeds rumors. Clear, honest communication builds confidence.
- Update employees so they know what is happening, what it means for their work and what to do (and not do).
- Message customers when appropriate, especially if their data or your ability to serve them is affected.
- Address legal and regulatory requirements. Depending on your industry and the data involved, you may have notification obligations with strict deadlines. Your legal counsel and cyber insurance carrier should be involved early.
What leaders should focus on
During an incident, leadership sets the tone. The most effective leaders focus on six things:
- Activating the incident response team quickly
- Understanding the scope before taking action
- Preserving evidence
- Containing further damage
- Establishing clear executive communications
- Documenting every decision
That last point is easy to overlook in the moment, but it is invaluable later for your investigation, your insurance claim, regulators, and the lessons you will apply next time.
Six common mistakes to avoid
Even well-prepared organizations make these mistakes under pressure:
- Wiping systems too quickly. It feels like progress, but it destroys the evidence you need to understand how the attacker got in and whether they are still there.
- Communicating before the facts are known. Early statements that later prove wrong can-do lasting damage to your credibility.
- Treating it as only an IT issue. A breach affects operations, finance, legal, customers, and reputation. Leadership needs to own the response.
- Failing to preserve evidence. Without it, you may never know the full story, and your insurer may ask tough questions.
- Using compromised email systems. If your email may be compromised, assume attackers can read your response plans. Move sensitive conversations to a secure, separate channel.
- Assuming only one system is affected. Attackers rarely stop at one machine. Verify before you declare anything clean.
Getting communication right
How you communicate during a breach can matter as much as how you contain it.
With employees:
- Share facts, not assumptions.
- Explain how operations are affected and what they should do.
- Create a sole source of truth so everyone hears the same message.
- Discourage speculation, inside the company and especially on social media.
With customers:
- Acknowledge the incident.
- Explain where the investigation stands.
- Commit to future updates and keep that commitment.
- Do not overpromise. It is far better to under promise and deliver than the reverse.
Your first 24-hour checklist
- Activate the response team
- Establish secure communications
- Preserve evidence
- Isolate affected systems
- Secure compromised accounts
- Notify stakeholders
- Engage legal counsel and your cyber insurance carrier
- Prepare employee messaging
- Prepare customer messaging
- Continue the investigation
The best time to plan is before you need to
Everything above is far easier with a plan already in place. Who is on your incident response team? Who calls your insurance carrier? Where will you communicate if email is down? Answering those questions on a calm Tuesday afternoon is much easier than at two in the morning in the middle of an incident.
The guidance in this article draws on the Cybersecurity and Infrastructure Security Agency (CISA) Cybersecurity Incident and Vulnerability Response Playbooks, along with industry incident response best practices. The full CISA playbooks are well worth a read for any leadership team.
You do not have to face it alone
At 2W Tech, we help manufacturers and distributors prepare for, respond to, and recover from cyber incidents. From building your incident response plan to 24/7 monitoring and managed security, our team is ready before, during and after a breach.
Read More: