Experiencing a cyber incident?

Do this now

Immediate steps for the first hour, based on CISA and FBI guidance.

1. Start an incident logWrite down what you saw, when, and every action taken, with times and names. It helps responders, insurers and regulators later.
2. Isolate affected systemsDisconnect affected devices from the network (unplug the cable, turn off Wi-Fi). Prefer disconnecting over shutting down, which can destroy evidence, unless you can't isolate the device any other way.
3. Communicate out of bandAssume attackers can read email and chat. Use phone calls or a separate, known-clean channel to coordinate the response.
4. Preserve evidenceDon't wipe, reimage or delete anything yet. Keep ransom notes, suspicious emails, screenshots and logs.
5. Call your key contactsYour incident response lead, legal counsel and cyber insurance carrier. Many policies require prompt notice and the use of approved response firms.
6. Secure accounts from a clean deviceDisable or reset compromised accounts, revoke active sessions, and turn on multi-factor authentication. Start with administrator and email accounts.
7. Report the incidentTo CISA and the FBI (below), and check whether laws, regulators, contracts or your insurer set a reporting deadline.

Avoid these mistakes

Common errors that make incidents worse.

• Wiping or rebuilding systems before evidence is preserved
• Discussing the response over a possibly compromised email or chat system
• Contacting the attackers or paying a ransom before talking to counsel and law enforcement. The FBI does not support paying ransoms, and payments to sanctioned parties carry legal risk.
• Announcing the incident publicly before counsel reviews what you say
• Restoring from backups before confirming they are clean and the attacker's access is closed
• Assuming it's over once one system is fixed. Attackers often keep other ways in.