Incident Response in the First 24 Hours: The Decisions That Define Your Exposure
The failure mode nobody talks about
Most incident response training focuses on technical containment. Isolate the host, kill the process, patch the vulnerability. That is correct and necessary. What gets less attention is the way well-intentioned technical responses destroy the evidence you will need three weeks later when a regulator asks what happened and why.
The most common costly mistake in the first hours of an incident is not failing to contain it. It is rebooting the compromised server. Or wiping the affected workstation. Or clearing logs to “start fresh.” Every one of those actions is understandable under pressure and every one of them makes your position worse.
Evidence preservation is not a compliance formality. It is the difference between being able to explain what happened and having to speculate.
Hour 0 to 2: get the basics right
Confirm the incident is real before you activate at full tempo. Alert fatigue is real and acting at full response pace on a false positive has costs. But once you have confirmed something is wrong, the priority order is: preserve, then contain, then recover.
Preserve means do not reboot, do not wipe, do not overwrite. Take forensic snapshots before you touch affected systems. Pull logs while they still exist. Document the system state as you found it.
Contain means isolate affected systems from the network, pull backups offline and label them as evidence, and disable compromised accounts or access pathways without deleting the audit trail.
In parallel: notify your incident response lead and your legal counsel. Both, immediately. Your insurance broker is also a call to make early because many cyber insurance policies have notification clauses that start clocks running from when you knew, not from when you told them. That distinction has cost organisations significant money.
The legal hold decision
Legal hold means preserving documents and records because litigation or regulatory investigation is reasonably anticipated. In a cyber incident, you should assume legal hold is triggered the moment you confirm the incident is real.
The reason this matters is that the opposite of legal hold is normal business operations, where documents get deleted, logs roll over, and backups get overwritten on schedule. All of those things are routine and all of them can be characterised as evidence destruction if litigation follows.
The practical step: notify whoever manages your document systems, log infrastructure, and backup processes to pause automated deletion until legal gives the all-clear. Do this in writing, with a timestamp.
Hour 2 to 6: scope and communicate
By this point you should be working to understand scope: how many systems, users, or records are affected, what the attack vector was, and what data was exposed or encrypted.
Engage your forensic or IR provider if you are not handling this in-house. Give them access to preserved snapshots, not the live systems. Their job is to reconstruct what happened from evidence, not to work inside the affected environment and contaminate it.
Communication decisions are now live. You need to know who needs to know, in what order, and by when. The list typically includes legal, leadership, your insurance broker, and depending on the data affected, a regulator. Draft the notification timeline before you send anything.
One practical note: keep incident response communications out of your normal systems. If the attacker has email access, your response discussion should not be in email. Use an out-of-band channel from the start.
The containment versus recovery tension
There is always pressure to restore services. Every hour of downtime has a visible cost. The evidence preservation effort is less visible because the risk it mitigates is future and uncertain.
In most incidents, the right call is to extend the containment phase longer than feels comfortable, because recovery into a partially-compromised environment often means going through the same incident again. The attacker’s initial access mechanism, the persistence they installed, the credentials they harvested: if these are not identified and removed before you restore, recovery is just a delay.
Forensic analysis takes time. Give it the time it needs.
Hour 6 to 24: close the gap and prepare to communicate
You should now be working towards a factual account of what happened. Implement fixes to prevent re-entry. Continue forensic analysis. Begin drafting your regulatory notification if one is required.
Regulatory notification timelines in Australia vary. Under the Notifiable Data Breaches scheme, you have 30 days from when you suspect an eligible data breach to notify the OAIC, though there is an initial 30-day assessment period. Sector-specific frameworks may move faster. Know your obligations before an incident, not during one.
Draft stakeholder communications based on facts, not speculation. State what happened, what you are doing, and what support is available. Avoid anything that looks like minimising the incident because that framing tends to get corrected publicly later, and the correction is always worse than the original disclosure would have been.
What consultants and incident responders should be doing in parallel
If you are consulting into an incident, your job is partly technical triage and partly helping the client make good decisions under pressure. The decisions that hurt clients most are rarely the technical ones. They are the decision to reboot before forensics, the decision to send an all-clear before scope is confirmed, and the decision to let normal backup deletion continue while the incident is active.
Your value is in slowing down the instinctive responses long enough to ask whether they are the right ones. That is a harder conversation than running the tools, and it is more important.
Keep records of every decision you make and every recommendation you give. Document when you gave it and what the client decided. This protects you as much as it protects the client.
The short checklist
Preserve: forensic snapshots, logs, backups labelled as evidence.
Legal hold: pause automated deletion, notify legal immediately.
Notify: legal counsel, insurance broker, IR provider, leadership.
Contain: isolate systems, disable compromised accounts, secure backup infrastructure.
Scope: determine affected systems, data, and users.
Communicate: draft notification timeline before sending anything.
Recover: only after scope is understood and persistence mechanisms are identified and removed.