Declare and organise
Create an incident record with time, severity, reporter, owner and affected service or asset.
Assign incident command and technical, evidence, communications and business owners.
Define a trusted coordination channel and meeting cadence.
Record known facts, assumptions, open questions and immediate risks separately.
Stabilise and contain
Protect people and critical services before pursuing perfect technical certainty.
Use the least destructive containment action that stops material harm and preserves evidence where feasible.
Protect privileged identities, backups, recovery infrastructure and security tooling.
Record every containment action, actor, timestamp and expected consequence.
Scope and investigate
Identify affected identities, assets, applications, data, locations and business processes.
Build a timeline from security, identity, endpoint, network, cloud and application evidence.
Search for related indicators, persistence and lateral movement.
Distinguish confirmed compromise from suspected or unaffected scope.
Preserve evidence
Preserve original logs and artefacts before destructive cleanup when feasible.
Record source, collector, time, method, hash or integrity information where appropriate.
Control evidence access and maintain custody history.
Escalate to qualified forensic or legal specialists when evidence may support litigation, regulation, insurance or law enforcement.
Eradicate and recover
Remove persistence, malicious changes and exposed credentials or secrets.
Patch, rebuild, restore or reconfigure affected systems from trusted sources.
Validate security controls and monitoring before returning services to normal operation.
Prioritise recovery by business impact and dependency, not convenience.
Communicate and govern
Provide time-stamped executive updates based on confirmed facts and decisions.
Coordinate legal, privacy, regulatory, insurer, customer, supplier or law-enforcement communication as required.
Record decision owners and the basis for material notifications or non-notifications.
Protect sensitive incident information from unnecessary disclosure.
Learn and close
Confirm all containment, recovery and monitoring criteria before closure.
Document root cause, contributing factors, control gaps and unresolved risk.
Create owned remediation actions with due dates and evidence requirements.
Review the incident for detection, response, resilience and governance improvements.
Boundary
This checklist is a Cybatar-authored coordination aid, not legal advice, a regulator-prescribed procedure, a substitute for qualified incident responders or a guarantee that every incident can follow the same sequence.