The incident is not waiting for certainty
A leaked file, impersonated executive, compromised mailbox or targeted disclosure rarely arrives with a complete explanation. The first evidence is partial. The legal position is still forming. The technical team wants to contain. The communications team wants to know what can be said. Leadership wants to know whether the matter is real. Meanwhile, someone else may already be deciding what the incident means. That is the public clock. It starts when an outsider can publish, contact a client, trigger a rumor, threaten disclosure or force a response. It does not wait for forensic certainty.
The first decision is authority
Before the organization can act coherently, it must know who can direct technical containment, retain specialists, preserve privilege where available, approve communications, contact authorities and accept operational consequence. If those rights are unclear, the response fragments. Technology makes irreversible changes. Communications creates a public position before the facts stabilize. Counsel is brought in after evidence has moved. Leadership receives competing versions of reality. A response plan without decision rights is a contact list.
The first 24 hours
Hour 0–2: establish the controlled room
- Name the incident director and the executive decision owner.
- Move the response to a channel not dependent on the suspected environment.
- Record what is known, what is inferred and what is unknown.
- Preserve relevant evidence before broad remediation alters it.
- Identify counsel, insurer, forensic and provider obligations that may affect the next step.
- Limit circulation to people with a defined role.
The objective is not secrecy for its own sake. It is to prevent uncontrolled statements and actions from becoming evidence, obligation or public fact.
Hour 2–6: define the decision frame
- What has actually happened?
- What systems, people and information may be affected?
- What can the suspected actor still do?
- Which reporting, contractual or regulatory clocks may apply?
- Who could learn of the matter independently?
- Which actions would contain the condition but destroy evidence or interrupt critical service?
The organization should also prepare a short internal truth statement: a few sentences separating confirmed facts from active hypotheses. Every decision should be tested against that statement until the evidence changes.
Hour 6–12: preserve options
Containment and communication must now move together. If accounts are disabled, clients may notice. If a provider is disconnected, operations may degrade. If a public statement is prepared, it must not commit the organization to facts the investigation cannot yet support.
- Define the conditions that would trigger client, regulator, authority, insurer or public communication.
- Prepare holding language that states what is known without disguising uncertainty.
- Identify the people who may be approached directly and give them a controlled route.
- Record the reason for material containment and disclosure decisions.
- Reassess whether the response channel and participants remain trustworthy.
Hour 12–24: take control of tempo
By this point the organization should have a working account of scope, a containment position, an authority map, a reporting view and a communications posture. None needs to be final. All must be coherent. The question is no longer simply whether an incident occurred. It is whether the organization can continue to make defensible decisions while facts, pressure and visibility change.
What not to do
- Do not wait for perfect attribution before containing a live path.
- Do not allow a technical severity score to determine reputational consequence.
- Do not make an absolute denial because the first evidence appears narrow.
- Do not use privilege as a label placed over ordinary operational discussion.
- Do not contact every stakeholder at once merely to demonstrate activity.
- Do not let the compromised system remain the only place where response authority exists.
The real outcome
A strong response does not guarantee that a private matter remains private. It does something more realistic: it preserves the client’s or institution’s ability to choose what happens next. That freedom is created in the first hours, before the incident acquires its public meaning.