Multiple servers encrypted, business operations stopped
- Activate Crisis Management Team
- Isolate all affected systems
- Notify executive leadership
- Engage external IR team
- Prepare public communications
Confirmed exfiltration of credit card data
- Notify legal and compliance
- Contact payment card brands
- Preserve all evidence
- Begin forensic investigation
- Prepare breach notifications
Unauthorized access to privileged account detected
- Disable compromised account
- Reset all admin passwords
- Review all recent admin activities
- Check for persistence mechanisms
Public-facing services experiencing significant degradation
- Enable DDoS mitigation
- Contact ISP/CDN provider
- Scale infrastructure if possible
- Monitor attack patterns
Single workstation infected with known malware
- Isolate infected endpoint
- Run full AV scan
- Check for lateral movement
- Reimage if necessary
User clicked link and entered credentials
- Reset user password
- Check for account compromise
- Block phishing URL
- Search for other victims
Multiple failed authentication attempts detected
- Verify source IP reputation
- Check if password spray attack
- Monitor targeted accounts
User installed unauthorized software
- Document violation
- Notify user's manager
- Schedule security awareness training