First 24 Hours: Incident Response Checklist

First hour

The suspected incident has been reported to whoever owns the decision to escalate.Immediate containment steps have been taken, without deleting logs or evidence.A rough initial assessment exists: what data, roughly how many people, how it seems to have happened.

First few hours

The right people are looped in: technical, legal, and whoever owns communications.A decision has been made on whether this is a personal data breach — if so, the Data Protection Board and each affected individual must be told.A written timeline has started, even if it's rough — what's known, and when it was learned.

Within 24 hours

Affected individuals who can be identified have been notified, or a plan exists to notify them without delay.The facts gathered so far have been written down somewhere durable, not just discussed verbally.Someone owns following up as more information comes in, including the detailed report due to the Board within 72 hours.

Don't skip

Evidence and logs relevant to the incident haven't been altered or deleted while fixing things.Internal communications about the incident are treated as sensitive, not shared more widely than necessary.

First 24 hours: incident response checklist

From the source