In most serious incidents, the technical response begins competently. Someone notices, someone escalates, engineers start containing. The part that goes wrong is above that layer, and it goes wrong in the first hour, in ways that are still being paid for weeks later.
What follows is not an incident-response plan. It is the short list of things leadership has to get right before the facts are clear, framed as decisions rather than procedures.
Minute zero to ten: establish who is running this
The most common early failure is ambiguity about command. Several capable people begin acting in parallel, each with partial information, and no one is accountable for the whole. Meanwhile the person best equipped to lead technical containment gets pulled into briefing executives.
Two roles need naming immediately, and they should not be the same person. An incident commander owns the response: sequencing, resourcing, and the decision log. A technical lead owns containment and works for the commander. Separating them protects the containment work from the reporting burden, which is the single highest-value structural choice available in the first ten minutes.
Name a scribe at the same time. Someone whose only job is to record what was known when, what was decided, by whom, and on what basis. This feels like overhead for about twenty minutes and then becomes the most valuable artifact in the entire response, because every subsequent conversation with insurers, regulators, counsel, customers, and the board is a question about the timeline.
Minute ten to twenty: decide what you are protecting first
Containment and continuity conflict. Isolating a segment stops the spread and may also stop production. Preserving forensic evidence and restoring service fast are frequently incompatible. Someone has to choose, explicitly, and the choice differs by organization and by incident.
The useful pre-work is a short priority order agreed while calm: which systems are protected first, which can be sacrificed to buy time, which must never be shut down without executive sign-off, and who holds that sign-off at three in the morning. Organizations that have this conversation in advance make the call in minutes. Those that have not can spend an hour discovering they disagree.
Minute twenty to thirty: get counsel and insurance in
Legal counsel and the cyber insurer belong in the room early, not after the technical picture stabilizes. Counsel shapes privilege over the investigation, which affects how findings can be handled later. Most policies carry notification requirements and panel-vendor obligations, and engaging a forensics firm the insurer has not approved is a way to compromise coverage during the one event the policy exists for.
The practical version: the incident commander should be able to reach both without hunting for a contact. That contact list belongs somewhere reachable when systems are down, which brings us to the next point.
Minute thirty to forty: assume your own tools are unavailable
Response plans stored on the file share that ransomware encrypted are a recurring theme. So are call trees in the email system that is compromised, and bridge lines documented in the wiki nobody can reach.
Leadership needs an out-of-band channel decided in advance: a communications method independent of the corporate estate, with the roster distributed on paper or on personal devices. It should be tested, because the first time an organization tries to convene twelve people on an unfamiliar platform under stress is not the moment to discover who never installed it.
Minute forty to fifty: say something internally
The information vacuum fills itself. Employees who know something is wrong and hear nothing official will speculate, and some will speculate to customers, on social platforms, or to journalists.
The first internal message does not need facts that do not exist yet. It needs to establish that the organization knows, that a response is underway, who is leading it, what employees should and should not do, and when the next update will come. Naming the next update time is what stops the vacuum from reopening every twenty minutes.
Minute fifty to sixty: hold the first structured update
By the end of the first hour, leadership should have converged on a short, disciplined status: what is confirmed, what is suspected, what is unknown, what has been decided, and what decisions are pending. Keeping those five categories separate is the discipline that matters. Most damaging early external statements come from stating a suspicion as a fact, then correcting it publicly.
Set the cadence for subsequent updates and hold it. Predictable rhythm reduces the number of people interrupting the response to ask for status.
What this reveals about readiness
Read back through those six blocks. Almost nothing in them is technical. They are decisions about authority, sequencing, communication, and record-keeping, and every one of them can be settled before an incident at essentially no cost.
That is why tabletop exercises earn their place. Not to rehearse malware analysis, but to discover that two executives believe they hold the same authority, that the recovery priority list does not exist in writing, that nobody knows the insurer’s notification window, or that the crisis bridge has never been dialed. Those findings are cheap in an exercise and expensive at three in the morning.
The organizations that handle major incidents well are rarely the ones with the most tooling. They are the ones where the first hour is a practiced sequence rather than an improvisation.