Incident Response Plan: The First 24 Hours
Primary Guard · November 12, 2026 · 4 min read
An incident response plan helps you act fast when attacked. See what to do in the first 24 hours and what to prepare before it happens.
An incident response plan is a written guide for what your team does when an attack happens. When something goes wrong late at night, nobody wants to invent a process. This article walks through the first 24 hours and what to prepare before an incident. A clear plan helps you act fast and stay calm.
Why you need an incident response plan
NIST says incident response is a critical part of cybersecurity risk management and should be integrated across organisational operations. Its guide SP 800-61r3, published in April 2025, replaces the older revision 2 and lines up with NIST Cybersecurity Framework 2.0. In plain words, response is a business job, not only an IT task.
Speed matters because damage grows with every hour. A plan removes guesswork about who decides, who calls whom and what to do first.
Incident response plan: the first hour
Start by naming one incident lead. This person makes decisions and keeps everyone informed. Then confirm what you are seeing, so you do not react to a false alarm.
Next, isolate the affected systems, for example by disconnecting them from the network. Keep the logs, and avoid wiping machines because that destroys evidence. Alert your incident contacts and inform senior management. Start a written record of what you saw and every action you take, with times.
Hours 1 to 8: contain and scope
Work out how far the problem has spread. Check which systems, accounts and data are affected. Reset passwords and sessions for any account that may be exposed. Block the addresses or files you know are malicious.
Use a communication channel that attackers cannot read, such as a phone call or a separate chat tool. If your email or main chat is compromised, they may be watching. Keep your list of actions up to date as you go.
Hours 8 to 24: decide and communicate
By now you should know enough to choose a recovery path. If systems were encrypted, restore only from backups that you have checked are clean. Rebuilding a system can be safer than cleaning it. Confirm that the attacker no longer has access before you reconnect anything.
Next, check who you must tell. Some incidents trigger reporting duties in Malaysia. Our guides to the Cyber Security Act 2024 and the PDPA explain the main rules. The Cyber Security Act guide notes that the reporting clock starts when the incident comes to your knowledge, so check early.
Finally, agree on one spokesperson for staff, customers and the press. Mixed messages cause more harm than short ones. Share only facts you have confirmed.
What to prepare before an incident
Write down names and phone numbers for your incident lead, IT team, management, legal adviser and key vendors. Keep a printed copy, because systems may be down. Test your backups by restoring a real file, not only by checking that jobs ran.
Make sure logging is switched on for key systems, so you have evidence to review. Then practise. A short tabletop exercise, where the team talks through a made-up attack, quickly shows gaps in the plan.
How Primary Guard helps
Primary Guard offers a 24/7 managed SOC and an Autonomous SOC service for monitoring and response. If ransomware is already a worry, try our free ransomware recovery triage. For lessons from a real Malaysian case, read our post on cyberattack response.
Not sure your team could respond within the first hour? Primary Guard offers a free assessment. Contact us to start the conversation.
Frequently asked questions
Who should be on the incident response team?
At a minimum, include an incident lead, someone from IT, a senior manager and a person who can speak for the company. Add legal or compliance advice when personal data is involved. Name a backup for each role.
How often should we test the plan?
Test it regularly, and after big changes such as new systems, new suppliers or staff turnover. Even a short discussion exercise will show missing contacts or unclear roles.
Do small businesses need a written plan?
Yes. A one-page plan with names, phone numbers and first steps is far better than none. You can add detail over time.
Key takeaway
A good incident response plan names who decides, what to do first and who to tell. Act in order: isolate, scope, recover and communicate. Prepare contacts, clean backups and logging before you need them.