A Cyber Incident Has Started. Who Makes the First Call?

During a cyber incident, ten people can act quickly in ten different directions. Someone rebuilds a server, someone emails customers and someone negotiates with a vendor. Speed matters, but uncoordinated speed can destroy evidence or create conflicting messages.

The first call should follow a response plan that already names decision-makers, technical support, legal counsel and the insurer’s incident channel.

Contain without wiping the trail

Isolate affected systems where appropriate, preserve logs and record every material action. Avoid deleting files or rebuilding machines until the forensic lead has considered the evidence. Continue critical operations through approved contingency procedures.

Check the policy before appointing vendors

Cyber policies may have consent, notification and panel-vendor requirements. The response team should know these before an emergency, not discover them after signing an engagement.

• Open an incident log with times, owners and decisions.
• Notify the insurer or broker through the stated channel.
• Coordinate technical, legal, privacy and communications work.
• Keep invoices and scopes of work tied to the incident.

One last thought

Run a tabletop exercise with the phone numbers in the room. A response plan becomes real only when the first three calls are obvious.

Coverage, exclusions, limits and claim requirements vary by insurer and policy. Read the customer information sheet and policy wording before you buy or renew.