Lesson 14 of 16 · Level 4: Expert
Incident Response, Step by Step
- ⏱ 15 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
- 📥 Downloadable template
In this lesson
- The difference between an event, an incident and a breach, and how to rate severity.
- The incident response lifecycle and how NIST SP 800-61 Rev. 3 ties it to CSF 2.0.
- What goes in a one-page incident response plan, and who does what.
- What to do in the first hour, including CISA's first steps for ransomware.
- Who to report to in the U.S. and the notification deadlines that may apply.
Use the incident log to record each incident's timeline, severity, actions and whether notification may be required; it counts open incidents and days open automatically.
- cybersecurity-checklist.xlsx · Incident Log sheet
Incident response is the plan you follow when something goes wrong: an account is taken over, ransomware appears, a laptop with client data disappears. Organizations that respond well aren't the ones that never get hit; they're the ones that decided in advance who leads, who to call, what to shut off and what to write down. This lesson gives you that structure, walks through the first hour minute by minute with a Charlotte accounting firm, and summarizes the U.S. reporting deadlines you need to know about. Legal topics are general information; in a real incident, involve an attorney early.
- Recognize an incident
- Prepare the plan
- Act in the first hour
- Report and notify
- Learn and improve
Event, incident or breach?
| Term | Meaning | Example |
|---|---|---|
| Event | Anything observable that happens on a system | A failed login; a blocked email attachment |
| Incident | An event that actually or potentially harms confidentiality, integrity or availability, or violates security policy | An employee's mailbox is accessed by an attacker |
| Breach | An incident in which protected data is accessed or acquired without authorization; the legal definition depends on the law that applies | The attacker downloads client tax returns |
Not every incident is a breach, and only legal counsel should decide whether something meets a breach definition. Your job during the incident is to contain it and preserve the facts that will make that decision possible.
Rate severity so everyone moves at the right speed
| Severity | Example | Response |
|---|---|---|
| Low | Malware blocked on one laptop; no data involved | Handle within a business day |
| Medium | One account compromised, quickly contained, no sign of data access | Same day; notify the security owner |
| High | Sensitive data likely accessed, or a key system down | Immediately; activate the plan and call outside help |
| Critical | Ransomware spreading, or large-scale data theft | All hands; leadership, legal, insurer and law enforcement |
The incident response lifecycle
For years, NIST's guide (SP 800-61 Rev. 2) described four phases that you'll still find in most training and exams:
- Phase 1PreparationA written plan, contact list, tools, backups, training and practice exercises, all before anything happens.
- Phase 2Detection and analysisConfirm what happened, which systems and data are involved, and how severe it is.
- Phase 3Containment, eradication and recoveryStop the spread, remove the attacker's access and tools, restore clean systems and watch for a return.
- Phase 4Post-incident activityA blameless review: what happened, what worked, what to change, and who owns each fix.
The April 2025 revision, SP 800-61 Rev. 3, reframes this around NIST CSF 2.0. Preparation lives in Govern, Identify and Protect; the response itself maps to Detect, Respond and Recover; and lessons learned feed improvement across all of them. The message is that incident response isn't a separate binder on a shelf; it's part of everyday risk management.
The one-page incident response plan
A small business doesn't need a 60-page document. It needs one page that anyone can follow at 2 a.m., stored where it can be reached even if email and file servers are down (printed, and on personal phones).
Many cyber insurance policies require prompt notice and may require you to use approved incident response firms and attorneys. Hiring your own forensics firm first can create coverage problems. Know your policy's rules before you need them.
The first hour: a real-world walkthrough
Queen City Tax & Accounting, the fictional Charlotte firm from lesson 9, had written its one-page plan in the 90-day project. On Tuesday, March 3, 2026, in the middle of tax season, it needed it:
- 9:12 a.m.AlertThe managed IT provider's monitoring flags a new inbox rule on a tax preparer's mailbox forwarding messages to an outside address, plus a sign-in from another state.
- 9:16 a.m.Out-of-band callThe office manager (incident lead) calls the preparer on her cell: she didn't create the rule. She mentions entering her password on a "shared document" page the day before.
- 9:24 a.m.ContainIT disables the forwarding rule, resets the password, revokes all sessions and re-registers MFA with a passkey.
- 9:40 a.m.ContainedNo further suspicious sign-ins. Logs are exported and preserved before any cleanup.
- 10:30 a.m.Scope and counselLogs show 41 forwarded emails, 6 with client tax documents attached. The insurer and outside counsel are notified to assess notification duties.
Twenty-eight minutes from alert to containment. Across the whole incident, the team spent about 12 hours:
- Detection and analysis (25%) 3 hReviewing sign-ins, mailbox rules and which emails were forwarded.
- Containment (8%) 1 hRule removed, password reset, sessions revoked, MFA re-registered.
- Eradication and recovery (50%) 6 hChecking other mailboxes, blocking the phishing domain, client communication prep.
- Post-incident review (17%) 2 hLessons learned and new controls, such as phishing-resistant MFA for all staff.
If it's ransomware: CISA's first steps
CISA's #StopRansomware Guide lists these priorities for the start of a ransomware response:
- Identify and isolate affected systems immediately. If several systems or subnets look affected, take the network offline at the switch level.
- Power down only if you can't disconnect a device from the network, because shutting down can destroy volatile evidence in memory.
- Coordinate out of band, by phone, so attackers watching email don't learn they've been detected.
- Triage for recovery using a predefined list of critical systems, and track which systems appear unaffected.
- Report to CISA, your local FBI field office, the FBI's IC3 (ic3.gov) or the U.S. Secret Service.
1. Several office PCs show ransom notes. What should happen first?
Isolation stops the spread. Rebuilding immediately destroys evidence you need to find out how attackers got in and what they took, and paying is never a first step.
2. Why does the plan say to coordinate by phone or a separate messaging app during an incident?
If email or the network is compromised, using it to coordinate tips off the attacker. Out-of-band communication keeps your response private.
Reporting and notification in the U.S.
Several obligations can run in parallel. Which ones apply depends on your industry, the data involved and where affected people live. This table summarizes common ones for general awareness:
| Obligation | Who it applies to | Deadline |
|---|---|---|
| State breach notification laws | Organizations holding covered personal data of residents (all 50 states, DC, Guam, Puerto Rico, USVI) | Varies by state; some set a fixed number of days, others say "without unreasonable delay" |
| FTC Safeguards Rule | Non-bank financial institutions such as tax preparers, for unencrypted data of 500+ consumers | Notify the FTC no later than 30 days after discovery |
| HIPAA Breach Notification Rule | Covered entities and business associates, for unsecured health information | Individuals within 60 days of discovery; HHS within 60 days if 500+ (and the media if more than 500 residents of a state); smaller breaches reported to HHS within 60 days after the end of the calendar year |
| SEC cybersecurity disclosure | Public companies | Form 8-K within four business days after determining an incident is material |
| Contracts and cyber insurance | Anyone with client contracts or a policy | Often short; check each contract and your policy |
Even when no law requires it, reporting crimes to the FBI (ic3.gov) or CISA helps law enforcement and sometimes helps victims. For fraudulent wire transfers, call your bank immediately: speed matters for any chance of recovering funds.
3. A Phoenix dental practice (a HIPAA covered entity) discovers a breach of unsecured records affecting 1,200 Arizona patients. Which notifications are required?
With 500 or more people affected, HHS is notified within 60 days along with the individuals, and media notice is required when more than 500 residents of a state are involved. State law may add requirements. The annual log is only for breaches under 500.
After the incident: learn, don't blame
Within two weeks, hold a blameless review: reconstruct the timeline, identify what allowed the incident and what limited it, and assign owners and dates to each improvement. Then update the risk register, the checklist and the plan itself. The Charlotte firm's review led to passkeys for all staff and an alert on any new forwarding rule.
Finally, practice. A 60- to 90-minute tabletop exercise walks leadership through a realistic scenario ("It's Friday at 4 p.m. and the bookkeeper's screen shows a ransom note…") to test the plan without touching real systems. CISA publishes free tabletop exercise packages you can adapt.
Common mistakes
Wiping and rebuilding before saving logs.
Preserve evidence first; you need it to scope the incident and decide on notification.
Keeping the only copy of the plan on the file server.
Print it and keep it on personal phones; assume systems will be down.
Announcing "no data was accessed" on day one.
Say what you know, what you don't yet and when you'll update. Early certainty often turns out wrong.
Punishing the person who clicked.
Thank fast reporting. Fear makes people hide incidents, which is far worse.
4. A tax firm covered by the FTC Safeguards Rule discovers on March 3, 2026 that unencrypted data of 700 clients was taken. What is the latest date to notify the FTC?
30 days after March 3 is April 2, 2026, and the rule says "as soon as possible," so earlier is better. May 2 would be 60 days, the HIPAA window, which doesn't apply here.
Practice exercise
On Monday, October 5, 2026, at 8:30 a.m., the office manager of a 15-person physical therapy clinic in Omaha finds that a laptop containing unencrypted patient records for about 650 Nebraska patients was stolen from her car over the weekend. Write the first-hour action list, then calculate the HIPAA deadline to notify patients and say whether HHS and media notice apply.
See solution
First hour:
- Open the incident log entry: time discovered, who reported it, what was on the laptop.
- Call the incident lead and the IT provider; attempt a remote lock and wipe, and record whether it succeeds.
- Disable or reset any accounts and saved credentials that were on the laptop (email, practice management, VPN), and revoke its sessions and certificates.
- File a police report (needed for insurance and notification records).
- Notify the cyber insurer and outside counsel to begin the breach risk assessment.
- Identify exactly which records were on the device, using backups and logs.
Deadlines: discovery on October 5, 2026 means patients must be notified without unreasonable delay and no later than 60 days later, December 4, 2026. Because 500 or more individuals are affected, HHS must also be notified within the same 60 days, and because more than 500 Nebraska residents are involved, prominent media serving the state must be notified too. Nebraska's state breach law may add requirements; counsel should confirm.
Lesson learned: full-disk encryption would likely have made this a lost-device report instead of a breach notification.
Summary
- Events are everyday occurrences, incidents cause or threaten harm, and breaches involve unauthorized access to protected data as defined by law.
- The lifecycle runs from preparation through detection, containment, eradication and recovery to lessons learned; NIST SP 800-61 Rev. 3 ties it to CSF 2.0.
- A one-page plan with a lead, contacts, an out-of-band channel and first steps makes the first hour fast and calm.
- For ransomware: isolate, coordinate out of band, preserve evidence and report to CISA or the FBI.
- U.S. deadlines vary: 30 days to the FTC under the Safeguards Rule, 60 days under HIPAA, four business days for public companies' SEC filings, plus state laws.
Next lesson: Cloud and Remote Work Security. You'll learn the shared responsibility model, fix the most common cloud misconfigurations and secure a team that works from anywhere.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.