The first hour of a cyber incident is for containment and evidence, not certainty

An incident rarely arrives with a complete map. Treat the first alert as a lead: record the account, host or service it identifies, then keep the entry point and full scope open until evidence supports them. Take the smallest safe action that limits further harm without erasing the evidence needed to understand it.

Stabilize without erasing the trail

An aggressive shutdown can destroy evidence or create another outage when the scope is still unclear. A shared timeline is more useful than several private theories.

Say only what the evidence supports

Early indicators can show that something is wrong without identifying the attacker, entry point or full impact. Separate observations from hypotheses and update both as evidence changes. The hour succeeds when harm is being contained, the record remains useful and the team knows what it must learn next.

A decision log prevents the response from becoming another mystery

Record who made each containment decision, when it happened, which evidence supported it and what the action was expected to protect. That log does not need polished prose during the first hour. It needs accurate times, owners and observations. Later, it helps the team distinguish an attacker’s activity from its own emergency changes, explain an outage and reverse a containment step safely. A short disciplined record can preserve context that memory loses as more responders join.