ISC Incident Response · Updated November 2026
A Cyber Incident Happens. What Should the Company Do First?
Do not jump straight to deleting malware. A structured response protects systems, evidence, and recovery.
Preparation
Define roles, tools, communication channels, training, and escalation procedures before an incident.
Identification
Determine whether an incident occurred and assess scope, systems involved, severity, and indicators.
Containment
Limit further damage through appropriate short-term and longer-term containment.
Eradication
Remove the root cause and malicious artifacts.
Recovery
Restore systems safely and monitor for recurrence.
Lessons learned
Document what happened, why, what worked, what failed, and what controls should change.
The takeaway
Contain before blindly destroying evidence. Recover only after the threat is understood and addressed.
Related Summit guides
FAQ
Is eradication the first step?
No.
Why preserve evidence?
Investigation, legal, regulatory, and improvement needs can require it.
Does response end when systems are restored?
No.