How to Respond to a Cyber Attack: A Step-by-Step Incident Response Plan

Under attack right now? Call Inovo's 24/7 emergency line at 800-598-4008, option 2.

This guide covers what incident response actually involves and gives business and IT leaders a 7-step framework for responding to a cyber attack. The framework draws on NIST's current incident response guidance and CISA's ransomware response checklist. You'll learn who to call first, how to contain an attacker without wiping the evidence you need later, which reporting deadlines apply to defense contractors, public companies, and healthcare organizations, and how to bring systems back without letting the attacker back in. In the middle of an incident? Go straight to Step 1. Building a plan ahead of time? Start with the prerequisites.

What It Means to Respond to a Cyber Attack

A few terms and principles need to be clear before the steps. They're what let you adapt the framework when your incident doesn't look like the textbook example.

Events, incidents, and breaches are different. NIST defines an event as any observable occurrence involving computing assets.¹ A failed login is an event. So is a blocked phishing email. An incident is an occurrence that actually or imminently jeopardizes the confidentiality, integrity, or availability of information or systems.² A breach goes one step further, because protected data was accessed or taken. Most events never become incidents, and plenty of incidents never become breaches. The distinction has teeth: the label decides which legal and contractual obligations apply.

Order matters. Contain the attack before you try to remove it. If you pull out only the pieces you've found, you can tip off an attacker who still has other ways in. Preserve evidence before rebuilding anything, since a rebuild wipes the record of what happened. And report on the regulator's timeline rather than your own. A correct action taken at the wrong point can still make an attack worse.

Preparation shapes the response. In April 2025, NIST replaced its Computer Security Incident Handling Guide (SP 800-61 Rev. 2) with SP 800-61 Rev. 3.³ The new guidance treats incident response as part of overall cybersecurity risk management, and NIST says all six Functions of its Cybersecurity Framework 2.0 play a role in it.³ Work done months before an attack, like assigning roles or testing backups, has a direct effect on how the response goes.

The cost of a slow response is measurable. IBM's 2026 Cost of a Data Breach research puts the global average breach at a record $4.99 million, which IBM translates to $1,100 per hour.⁴ The same research found that AI and automation saved organizations an average of $1.93 million per breach.⁴

Here are the terms used throughout this guide.

Term	Plain-Language Definition	Why It Matters in the First 72 Hours
Security event	Any observable occurrence involving computing assets, such as a failed login, a blocked email, or an unusual cloud sign-in¹	Most events are harmless; triage decides which become incidents
Security incident	An occurrence that actually or imminently jeopardizes the confidentiality, integrity, or availability of information or systems without lawful authority²	Declaring one activates the plan and can start reporting clocks
Data breach	An incident in which protected data is accessed, acquired, or disclosed without authorization	Triggers notification laws a contained incident may not
Indicator of compromise (IOC)	Evidence an attacker has been present, such as a malicious IP address, file hash, or rogue account	Guides scoping and tells you when eradication is complete
Lateral movement	An attacker moving from the first compromised system to others	Explains why isolating one laptop is rarely enough
Persistence	Footholds an attacker plants to regain access, such as rogue accounts, backdoors, or scheduled tasks⁵	Must be removed before restoring, or the attacker returns
Containment	Actions that stop the attack from spreading while you investigate	Limits damage without destroying evidence
Eradication	Removing the attacker's tools, accounts, and access from every system	Done after scoping, or you remove only what you've found
Out-of-band communication	Coordinating through channels the attacker can't see, such as phone calls⁵	Keeps an attacker watching email from learning you've spotted them

What to Have in Place Before a Cyber Attack

Some of what you'll need during an attack can't be set up once it starts. An offline phone list does you no good if it only lives in the email system that just went down. Work through this checklist now. If you're responding to an active incident, skip to Step 1 and come back later.

Prerequisite	Why You Need It Before an Attack	Typical Owner	In Place?
Written incident response plan with severity levels and authority to declare an incident	Removes debate about who decides and when the plan activates	Executive sponsor and security lead	Yes / No
Offline contact list (personal phone numbers) for the team, MSP, counsel, insurer, and IR firm	Email and chat may be compromised or down, and attackers may be watching them⁵	Incident lead	Yes / No
Ranked critical asset list	Restoration should follow a predefined list of systems critical to safety, revenue, and operations⁵	IT or MSP with business owners	Yes / No
Offline, encrypted, tested backups	Many ransomware variants try to find and delete or encrypt any backups they can reach⁶	IT or MSP	Yes / No
Centralized logging with adequate retention	Short retention can erase the record of how the attacker got in; CISA recommends keeping logs for critical systems at least one year where possible⁶	MSP or SOC provider	Yes / No
24/7 monitoring and endpoint detection and response	Centrally monitored detection can catch precursor malware and attacker activity before ransomware is deployed⁶	SOC or MDR provider	Yes / No
DoD-approved medium assurance certificate for cyber incident reporting (DoD contractors)	Required to file the DFARS cyber incident report⁷; getting one mid-incident burns the 72-hour window	Compliance or contracts lead	Yes / No
Cyber insurance policy terms and claims hotline	Your policy's notice and vendor terms govern the claim, so know them before you need them	CFO or finance lead	Yes / No
Breach counsel and an incident response firm identified in advance	Avoids vetting vendors under pressure	Legal and security lead	Yes / No
Tabletop exercise in the last 12 months	CISA calls for regularly exercising the incident response plan and offers no-cost tabletop exercise packages⁶	vCISO or security lead	Yes / No

How to Respond to a Cyber Attack: The 7-Step Framework

Seven steps take you from the first sign of trouble to a closed incident. Work through them in order, with one exception. Step 5, reporting, begins the moment you declare an incident and runs alongside Steps 2 through 4, because legal deadlines keep running while you investigate.

The table summarizes each step. Details follow.

Step	What You Do First	Why It Works	You're Done When	Typical Owner
1. Activate your team and go out-of-band	Call the core team and counsel by phone; start a timestamped log	Attackers may be watching email; discovery time starts legal clocks⁵˒⁷	A named incident commander is running a live log	Executive sponsor and incident lead
2. Scope the attack and set severity	Review EDR, identity, VPN, and firewall logs; classify affected data	You can't contain what you haven't found; data type sets obligations⁵	Affected, suspected, and clean systems are listed	Incident lead with MSP or IT
3. Contain without destroying evidence	Disconnect affected systems; close remote access paths	Cuts off the attacker while keeping memory intact⁵	No new systems show indicators	MSP or IT, directed by incident lead
4. Preserve evidence	Image disks and memory; collect logs and malware samples	Evidence shows what was taken and supports reporting⁵˒⁷	Evidence is stored off-network with chain of custody	IR firm or forensic lead
5. Meet reporting obligations (starts at Step 1, runs in parallel)	With counsel, map the incident to contracts and regulations	Deadlines run from discovery or materiality, not resolution⁷˒⁸˒⁹	Required reports are filed and confirmed	Counsel and executive sponsor
6. Eradicate and recover	Remove persistence; rebuild and restore in priority order	Restoring first lets the attacker back in⁵	Critical systems run clean under heightened monitoring	MSP or IT with incident lead
7. Close and harden	Formally close the incident; hold a lessons-learned review	Response feeds back into preparation³˒⁵	Incident closed; after-action report and remediation items assigned	Incident lead and leadership

Step 1: Activate Your Response Team and Move to Out-of-Band Communication

The first hour sets up everything else. Get the right people making decisions, and keep them on channels the attacker can't read.

• Declare a suspected incident under your plan. Suspicion is enough to activate the team.

• Call, don't email, the incident lead, executive sponsor, MSP or IT lead, counsel, and your insurer's claims line. Name one incident commander.

• Get counsel on that first call. The reporting work in Step 5 starts now.

• Move all incident discussion to phone calls or a pre-arranged channel outside corporate email and chat.

• Start a timestamped incident log: when the problem was discovered, who found it, what they saw, and every action taken from that point on.

Why it works: After a compromise, attackers often watch internal communications to see whether they've been detected.⁵ Phone calls keep them guessing. The discovery time in your log matters because DFARS reporting runs 72 hours from discovery.⁷

You're done when: One incident commander is named, the core team and counsel are on a call, and the log is running. 

Warning: Don't wait to be certain. Treat a suspected incident as real until scoping proves otherwise.

Step 2: Scope the Attack and Set a Severity Level

You can't stop what you haven't found. Scoping tells you where the attacker is, how they're moving, and what data they can reach.

• Determine which systems are affected using your EDR, SIEM, firewall, VPN, and identity logs.⁵

• Look for signs of a wider intrusion: newly created or newly privileged accounts, unusual VPN logins, unexpected remote monitoring and management tools, unexpected PowerShell activity, and tampering with backups or shadow copies.⁵

• Identify the data on affected systems. For DoD contractors, that includes the covered defense information protected under DFARS 252.204-7012.⁷ Also check for protected health information, other personal data, and financial data, since the data type decides which obligations apply.

• Write a one-paragraph working summary, set a severity level under your plan, and send it to counsel for the Step 5 analysis.

Why it works: Ransomware is often evidence of an earlier compromise that was never resolved.⁵ The first infected machine you find is rarely the only one.

You're done when: You have lists of confirmed, suspected, and unaffected systems, the data types involved, and a severity level.

Step 3: Contain the Attack Without Destroying Evidence

Containment cuts the attacker off. Done well, it also leaves affected systems intact so investigators can figure out what happened.

• If several systems or subnets are affected, take the network offline at the switch level. If that isn't possible right away, unplug affected devices or remove them from Wi-Fi.⁵

• Isolate systems in one coordinated move, not one at a time.⁵

• Disable the access paths the attacker used, including VPNs, remote access servers, single sign-on, and public-facing assets. Disable compromised accounts too.⁵

• For cloud resources, snapshot the affected volumes for forensic review.⁵

• Power a device down only if you can't disconnect it. Shutting it off erases evidence held in memory.⁵

Why it works: CISA warns that attackers who realize they've been found may move to other systems or push ransomware out more widely before the network goes offline.⁵ A single coordinated cutoff gives them no warning. Keeping devices on, just disconnected, preserves the memory evidence that shows how they got in.

You're done when: No new systems show indicators of compromise and every known access path is closed.

Warning: Don't pull the plug on everything. Disconnect, don't power off.

Step 4: Preserve Evidence Before Anything Is Wiped or Rebuilt

Everyone will want systems back fast. Evidence still comes first, because a wiped or rebuilt machine can't tell you anything.

• Capture disk images and memory from a sample of affected workstations, servers, and cloud instances.⁵

• Preserve evidence that expires quickly, such as system memory, Windows Security logs, and firewall log buffers, and collect samples of precursor malware along with indicators of compromise.⁵ Add EDR telemetry, Microsoft 365 audit logs, and copies of any ransom notes.

• Store evidence off the affected network and document chain of custody.

• DoD contractors: preserve images of affected systems and relevant monitoring and packet capture data for at least 90 days from the date you submit the incident report. Any malicious software you isolate goes to the DoD Cyber Crime Center (DC3).⁷

Why it works: Regulators, insurers, and customers will all ask what was taken. Without evidence you can't answer, and the most useful evidence (memory and short-retention logs) is the first to disappear.⁵

You're done when: Evidence is collected, stored securely off-network, and retention is set.

Step 5: Determine Your Reporting Obligations and Notify on Time

Counsel leads this step, and your technical team feeds it facts as they come in. Keep in mind it started back in Step 1.

• With counsel, list every obligation that could apply: contract clauses, regulations, state breach laws, customer contracts, business associate agreements, and your insurance policy. The full deadline table comes after this framework.

• Defense contractors: report within 72 hours of discovery, using a DoD-approved medium assurance certificate.⁷ Mandatory reports go through DC3's Incident Collection Format portal at dibnet.dod.mil.¹⁰ Subcontractors also give the DoD-assigned report number to their prime or next higher-tier contractor.⁷

• Public companies: determine whether the incident is material without unreasonable delay after discovery, then file Form 8-K Item 1.05 within four business days of that determination.⁸

• Healthcare covered entities and business associates: follow HIPAA's breach notification timelines.⁹

• Consider reporting to CISA, your local FBI field office, the FBI's Internet Crime Complaint Center (IC3), or the U.S. Secret Service. Federal law enforcement may know of decryptors for some ransomware variants.⁵

• Track every clock, owner, and filing confirmation in the incident log.

Why it works: Reporting clocks start at discovery or at a materiality determination, and the SEC doesn't allow companies to stall that determination.⁷˒⁸ A clean technical response won't fix a late filing.

You're done when: Every applicable report is filed and the confirmations are saved.

Warning: File what you know when the deadline arrives, even if the investigation isn't finished. Public companies amend their Form 8-K as new information is determined,⁸ and DC3 strongly encourages follow-on reports after the initial 72-hour DFARS submission.¹⁰

Step 6: Eradicate the Threat and Restore Operations

Now you remove the attacker for good and bring systems back deliberately, not all at once.

• Hunt for persistence: rogue accounts, backdoors on perimeter systems, unexpected scheduled tasks or remote tools, and penetration testing tools such as Cobalt Strike that attackers misuse.⁵

• Remove malware and close the entry point, whether that means patching an exploited vulnerability or fixing a misconfiguration.

• Rebuild systems from known-good images in the order set by your critical asset list.⁵

• Restore data from offline, encrypted backups into a clean environment. Don't reconnect anything that's still infected.⁵

• Reset passwords and rotate keys only after the environment is cleaned and rebuilt, so the attacker can't capture the new credentials.⁵

• Keep heightened monitoring in place. 

Why it works: Ransomware is often dropped on top of earlier “dropper” malware. Restore before that malware is found and removed, and you reinfect the environment.⁵

You're done when: Critical systems are restored in priority order and running clean under heightened monitoring. Formal closure happens in Step 7.

Step 7: Close the Incident and Harden Against the Next One

Once systems are stable, close the incident properly. What you learn here goes straight into your next round of preparation.

• Formally close the incident against your plan's defined criteria once monitoring shows no recurring indicators.⁵

• Hold a lessons-learned review that identifies the root cause, timeline, what worked, and what slowed you down. 

• Update the response plan, playbooks, and contact list based on what you learned.⁵

• Turn gaps into tracked remediation items with owners and dates. CMMC clients should update their plan of action and milestones (POA&M). Then schedule a tabletop exercise to test the changes.

• Consider sharing indicators of compromise with CISA or your sector's information sharing and analysis center (ISAC).⁵

Why it works: NIST's current guidance builds incident response into the wider cybersecurity program, with all six CSF 2.0 Functions involved.³ An incident you've reviewed and fixed becomes part of your preparation for the next one.

You're done when: The incident is formally closed, a written after-action report exists, and every remediation item has an owner.

Cyber Attack Reporting Deadlines by Regulation

Reporting clocks don't all start at the same moment. DFARS starts at discovery. SEC disclosure starts when a public company decides an incident is material, and that decision has to be made without unreasonable delay.⁷˒⁸ All of these clocks run while technical work is still going on.

The table lists the obligations defense contractors, public companies, and healthcare organizations run into most often.

Requirement	Applies To	What Starts the Clock	Deadline	Report To
DFARS 252.204-7012 incident report	DoD contractors and subcontractors handling covered defense information (CDI: controlled unclassified information that DoD provides for a contract, or that the contractor collects, develops, or stores while performing it)⁷	Discovery of a cyber incident affecting a covered system, CDI, or operationally critical support⁷	72 hours⁷	DoD through DC3's Incident Collection Format portal at dibnet.dod.mil (medium assurance certificate required)⁷˒¹⁰; subcontractors also give the report number to the prime or next higher-tier contractor⁷
DFARS 252.204-7012 media preservation	Same as above	Submission of the incident report⁷	Preserve images and monitoring data at least 90 days⁷	Available to DoD on request⁷
SEC Form 8-K, Item 1.05	Public companies	Determination that the incident is material, which must be made without unreasonable delay after discovery⁸	4 business days⁸	SEC filing, amended by Form 8-K/A as new information is determined; delay only if the U.S. Attorney General notifies the SEC in writing of a substantial risk to national security or public safety⁸
HIPAA, individual notice	Covered entities	Discovery of a breach of unsecured PHI⁹	Without unreasonable delay, no later than 60 days⁹	Affected individuals⁹
HIPAA, HHS notice (500 or more individuals)	Covered entities	Discovery of the breach⁹	Without unreasonable delay, no later than 60 days⁹	HHS Secretary via the online breach report form⁹
HIPAA, HHS notice (fewer than 500 individuals)	Covered entities	Discovery of the breach⁹	No later than 60 days after the end of the calendar year in which the breach was discovered⁹	HHS Secretary⁹
HIPAA, media notice (more than 500 residents of a state or jurisdiction)	Covered entities	Discovery of the breach⁹	Without unreasonable delay, no later than 60 days⁹	Prominent media outlets serving the state or jurisdiction⁹
HIPAA, business associate notice	Business associates, including MSPs serving healthcare clients	Discovery of the breach⁹	Without unreasonable delay, no later than 60 days⁹	The covered entity⁹
State breach notification laws	Organizations holding residents' personal information	Varies by state; NCSL maintains a state-by-state list⁶	Varies by state; confirm with counsel⁶	Affected residents⁶, plus any state agencies the law names
Cyber insurance policy	Policyholders	Per policy terms	Per policy terms	Carrier claims line
Voluntary federal reporting	Any organization	Not applicable	As soon as practical	CISA, local FBI field office, FBI IC3, or U.S. Secret Service⁵

Have counsel confirm which rows apply to you. Customer contracts can add shorter deadlines of their own.

Why Your First Instincts Can Make a Cyber Attack Worse

Under pressure, people grab for whatever feels decisive. Many of those moves backfire, and the reasons trace back to how attackers operate.

First Instinct	Why It Backfires	Do This Instead
Shut every computer off	Powering down erases evidence held in memory⁵	Disconnect from the network; power down only if you can't isolate⁵
Email the company to warn everyone	Attackers often watch internal email and may deploy ransomware more widely if they see they've been found⁵	Use phone calls or a pre-arranged out-of-band channel⁵
Restore from backup right away	Ransomware often rides on earlier dropper malware; restoring before it's removed reinfects you⁵	Remove persistence, rebuild from clean images, then restore⁵
Reset every password immediately	If the attacker still has access, they can capture the new credentials⁵	Disable compromised accounts during containment; complete resets after cleanup⁵
Wait for the full picture before reporting	DFARS runs from discovery, and the SEC materiality determination can't be put off to buy time⁷˒⁸	Start Step 5 at Step 1 and file on the regulator's clock
Pay the ransom to end it quickly	Payment doesn't guarantee decryption, an end to the compromise, or that stolen data stays private, and it may create sanctions risk¹¹	Consult law enforcement and counsel first; decryptors may exist⁵
Let IT handle it quietly	Legal, insurance, and disclosure decisions sit outside IT; CISA lists insurers and security service providers as stakeholders⁵	Activate the full team in Step 1

Nearly every row has the same root problem: a reasonable action taken too early or out of sequence. Moving fast only helps once the order is right.

Who Does What During a Cyber Attack

Most mid-market companies don't have a full-time security leader on staff, so response roles have to be assigned ahead of time. They usually end up split across the MSP or internal IT team, outside advisors, and leadership.

Role	What They Own During the Attack	Who Typically Fills It at a Mid-Market Company
Incident commander	Priorities, decisions, the incident log, and coordination	Internal security lead, vCISO, or retained IR firm
Executive sponsor	Business decisions on downtime, spending, and disclosure	CEO, COO, or CFO
Technical responders	Isolation, imaging, rebuilds, and restores	Internal IT team and/or MSP
Monitoring and threat hunting	Detection, alert triage, and hunting for persistence	SOC or MDR provider
Legal counsel	Privilege, notification analysis, and regulator contact	Outside breach counsel
Cyber insurer	Claim handling, approved vendors, and coverage decisions	Carrier claims team
Communications	Messages to employees, customers, partners, and media	Marketing or communications lead, with counsel review
Law enforcement and CISA	Investigative support, threat intelligence, and decryptor information	FBI field office, FBI IC3, or CISA⁵

A CISO-led advisor fills the role at the top of that table. The advisor sets priorities and makes the security calls, and your MSP or internal IT team handles the hands-on technical work it already knows. That's how we work at Inovo InfoSec. Our CISO-led team is tool-agnostic and partners with MSPs and internal IT teams instead of replacing them.

Responding to a Cyber Attack Is a Process You Can Prepare For

You now know how events, incidents, and breaches differ, why the order of response matters, and the seven steps that run from the first phone call to a closed incident. You've also seen which reporting clocks may apply and who should own each decision.

No written plan yet? Start with the prerequisites checklist and run a tabletop exercise against it. If the exercise turns up gaps, the next move is an assessment that measures them against a recognized framework. At Inovo, that's our Security Maturity Level Assessment, the first step in our Assess, Remediate, Manage approach. Our CISO-led team works alongside your MSP or IT staff, and if you're dealing with an active incident, our 24/7 emergency line is 800-598-4008, option 1.

Contact Us

References

1. National Institute of Standards and Technology, Computer Security Resource Center. “Event” (definition from NIST SP 800-61 Rev. 3). Glossary. https://csrc.nist.gov/glossary/term/event

2. National Institute of Standards and Technology, Computer Security Resource Center. “Cybersecurity Incident” (definition used in NIST SP 800-61 Rev. 3). Glossary. https://csrc.nist.gov/glossary/term/cybersecurity_incident

3. National Institute of Standards and Technology. “NIST Revises SP 800-61: Incident Response Recommendations and Considerations for Cybersecurity Risk Management.” April 3, 2025. https://www.nist.gov/news-events/news/2025/04/nist-revises-sp-800-61-incident-response-recommendations-and-considerations

4. IBM (Limor Kessem, X-Force). “AI-powered adversaries and the enterprise risk challenge: Preparing for the new reality” (2026 Cost of a Data Breach findings). July 29, 2026. https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk

5. Cybersecurity and Infrastructure Security Agency. “I've Been Hit By Ransomware! Ransomware Response Checklist” (from the #StopRansomware Guide, updated May 2023). https://www.cisa.gov/stopransomware/ive-been-hit-ransomware

6. CISA, FBI, NSA, and MS-ISAC. “#StopRansomware Guide,” Part 1: Preparing for Ransomware and Data Extortion Incidents (web version). https://www.cisa.gov/stopransomware/ransomware-guide

7. Electronic Code of Federal Regulations. “48 CFR 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024).” Paragraphs (a), (c), (d), (e), and (m). https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7012

8. U.S. Securities and Exchange Commission. “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure,” Final Rule, Release No. 33-11216. July 26, 2023. Summary table, p. 12; Instruction 1 discussion, pp. 37-38. https://www.sec.gov/files/rules/final/2023/33-11216.pdf

9. U.S. Department of Health and Human Services. “Breach Notification Rule.” Content last reviewed July 26, 2013. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

10. DoD Cyber Crime Center (Terry Kalka, Director, DC3 DCISE). “Securing the Defense Ecosystem,” slide: Mandatory Cyber Incident Reporting. AFCEA TechNet Augusta 2026. https://events.afcea.org/Augusta26//Custom/Handout/Speaker0_Session12980_1.pdf

11. CISA, FBI, NSA, and MS-ISAC. “#StopRansomware Guide” (full PDF, Publication October 2023), Part 2: Ransomware and Data Extortion Response Checklist. https://www.cisa.gov/sites/default/files/2025-03/StopRansomware-Guide%20508.pdf