THE SHORT ANSWER
When compromise is suspected, stop unsafe activity, contain affected access, verify what is known, preserve evidence, reset or revoke credentials through trusted channels, involve qualified responders, communicate appropriately, recover safely and document lessons.
STOP → CONTAIN → VERIFY → PRESERVE → REVOKE → COMMUNICATE → RECOVER → LEARN
The order can overlap, and specialists may change it for the incident. Avoid wiping devices, deleting logs or announcing conclusions before evidence and obligations are understood.
Prepare trusted contact paths
- Incident owner and deputy
- Technology/security responder
- Legal, privacy and insurance contacts where applicable
- Critical vendors and payment providers
- Approved internal and external communication owners
- Offline copy of the response plan
Escalate consequential cases
Account compromise, malware, data exposure and payment fraud can require specialist investigation and jurisdiction-specific notification. This resource is preparedness guidance, not forensic or legal advice.
Turn guidance into an owned business action
Choose one relevant account, system, data set or workflow. Record the owner, current control, most important failure, detection signal, response step and recovery dependency. Escalate specialist, legal or regulatory questions to qualified advisers for the applicable context.
Sources & further reading
- The NIST Cybersecurity Framework 2.0
National Institute of Standards and Technology. Current outcome-based guidance for governing, identifying, protecting, detecting, responding to and recovering from cybersecurity risk. It does not prescribe one implementation.
- Guidance for MSPs and Small and Mid-sized Businesses
Cybersecurity and Infrastructure Security Agency. Defensive guidance covering protected backups, access and recovery preparation. Teams should adapt it with qualified specialists to their systems and obligations.
Examples and exercises are illustrative unless attributed to a source. No independent expert review is claimed.
A correction, a counterexample or an experience worth sharing?
Join the conversation ↗