The first hour of an incident

Do not pull the power. Volatile memory holds the things you will want most in six hours: encryption keys, injected processes, live network connections, credentials in use, and malware that exists nowhere on disk. Some ransomware strains keep their keys in memory right up until the machine restarts. Power the box off and that material is gone permanently.

The correct move is to cut the network and leave the power on. If you run an EDR platform, use its network containment feature; it severs everything except the management channel, which keeps your visibility intact. Failing that, disable the switch port, drop the machine from Wi-Fi, or physically unplug the cable. The machine stays on, isolated, and available for a memory capture.

The same logic applies off the desktop. In Azure, snapshot the disk before you touch anything, then isolate the VM with network security group rules and keep it. For a compromised identity, revoke sessions and refresh tokens in Entra ID and disable sign-in, leaving the account in place: deletion erases the audit trail and breaks every correlation you will need when you reconstruct what the account touched.

Log retention runs on fixed schedules: Entra ID keeps sign-in logs for seven days on the free tier and thirty days with a P1 or P2 licence, unless you have already shipped them somewhere else.

Firewall and VPN appliances often hold only days. If the intrusion started three weeks ago, the evidence of initial access may be days from ageing out while you deliberate. Export sign-in logs, audit logs and perimeter logs now, to storage the attacker cannot reach, even if you never end up needing them.

At the same time, start an incident log. A plain document, kept outside the compromised environment, recording in UTC who did what, when, and what they observed. Photograph ransom notes and anything strange on screen with a phone, and take no screenshots on the affected machine.

Keep a contemporaneous record and a clean chain of custody; insurers, regulators and courts ask for both. The same record is the raw material for the breach assessment the Privacy Act will require of you later.

The first call is to whoever can authorise taking a revenue system offline and approve spend. The costliest delays happen while engineers wait for a decision nobody in the room can make.

The second call is your cyber insurer, and it should come earlier than most people expect. Many policies require the insurer to be notified before external responders are engaged, and most operate panels of approved forensic and legal firms. Engaging your own responder first can complicate or jeopardise cover. Keep the insurer's policy number and incident hotline on paper in the plan, since the mailbox may be compromised.

Then the external machinery. Engage forensic investigators through legal counsel where you want any prospect of privilege over the findings; Australian courts look at why a report was commissioned, and have declined privilege over breach reports commissioned for mixed business purposes. Report the incident to the ACSC through ReportCyber.

If personal information is likely involved, the Notifiable Data Breaches scheme under the Privacy Act 1988 gives you up to thirty days to assess whether an eligible data breach has occurred, and once you form that belief, notification to the OAIC and affected individuals must follow as soon as practicable. And if the incident ends in a ransom payment, the Cyber Security Act 2024 requires businesses above the small business turnover threshold to report the payment within seventy-two hours.

First: does the revenue system come offline? This is the decision people avoid in the moment, so make it in advance. Agree the thresholds while nobody is under pressure: what evidence of spread justifies disconnecting the platform that makes the money, and who says go. With the threshold agreed, the call at 2am follows a written rule.

Second: when do credentials rotate? The reflex is to reset the obviously compromised password immediately, and it is usually wrong. A modern intruder persists beyond the password: inbox rules that forward mail, OAuth application grants, freshly registered MFA methods, service principal secrets. Reset one credential and you tell the attacker you are onto them while leaving their other doors open.

Scope first. Then rotate every affected credential at once, with session and token revocation, so the attacker gets no early warning and no account left open.

Third: where does the response team talk? Assume the attacker reads the mailbox until proven otherwise. Coordinating the response inside the compromised tenant hands them your containment plan in real time. Move to out-of-band channels immediately: phones, a messaging group on personal devices, or a clean tenant kept for exactly this purpose.

Keep the plan to one printed page, in a drawer as well as a drive:

Then rehearse it. A one-hour tabletop twice a year, walking a plausible scenario against the page, finds stale numbers and unowned decisions. Pair it with a tested restore, because the Essential Eight's regular backups strategy assumes a restore has been tested. Black Shard writes and rehearses this plan in its vCISO engagements.

The test worth applying today is simple. Could your most junior on-call person, alone at 2am, isolate a machine without powering it off, find the incident log template, and name the first three phone calls? This note is general information and is not legal advice; take counsel on your organisation's specific obligations.