What to Do in the First 4 Hours of a Cyber Incident

A cyber incident in progress is the worst time to figure out who to call, what to preserve, and what to shut down. The confusion of an active incident — staff locked out of systems, phones ringing, management demanding answers — makes clear thinking nearly impossible. The businesses that recover fastest from cyber incidents are the ones that made decisions about what to do before the incident happened.

Define the Incident Type First

Not every suspicious event is a major incident. A staff member receiving a phishing email and reporting it without clicking is a near-miss, not an incident requiring full response. A ransomware infection actively encrypting files is a major incident. The response actions differ significantly, so a brief initial assessment — what type of incident, what is the scope, is it still active? — shapes everything that follows.

Hour 0–1: Contain

For an active incident (malware spreading, account compromise in progress, active data exfiltration): the first action is containment. Isolate affected systems from the network — unplug ethernet, disable Wi-Fi, power down if necessary to prevent spread. If an account has been compromised, suspend it immediately via your identity management system. Change admin passwords from a clean device not on the affected network.

Critically: do not turn off affected machines and wipe them immediately. Forensic evidence in memory and on disk is needed to understand what happened, what was accessed, and whether your incident response actions are effective. The exception: if you have no forensic capability and the alternative is continued active spread, containment through power-off is preferable to allowing ongoing compromise.

Hour 1–2: Notify Your IT Provider

Call your IT provider — not email, which may be compromised. Your IT provider's incident response process should activate: they should be able to help with remote forensics, access your management tools to assess scope, and begin guiding containment and recovery. If you don't have a managed IT provider, contact a cyber incident response firm — organisations like Aura Information Security or your cyber insurer's preferred responder.

Notify senior management. Document everything — screenshot ransom notes, error messages, and any information displayed. Write a timestamped log of events as you learn them. This documentation is critical for insurance claims and any subsequent investigation.

Hour 2–4: Assess and Notify

With containment achieved and your IT team working on scope assessment, attention turns to notification obligations. Does the incident involve personal information? If so, under the NZ Privacy Act 2020, you may have an obligation to notify the Privacy Commissioner and affected individuals. Legal advice here is worth the cost of a phone call — the notification threshold has consequences either way.

Notify your cyber insurer if you have a policy. Most cyber insurance policies have notification windows (often 24–72 hours) and preferred incident responders. Engaging your insurer early can reduce response costs and improve outcomes.

The Incident Response Checklist Every Business Needs

• IT provider emergency contact number (mobile, not desk phone)
• Cyber insurer policy number and emergency contact
• List of critical systems and recovery priorities
• Backup location and access credentials (stored offline)
• Communication template for notifying staff and customers
• Legal advisor contact for Privacy Act notification guidance

Incident response is a skill, and like all skills, it's vastly better when practiced in advance. A written plan reviewed annually is the minimum preparation — a tabletop exercise with your key staff is better.