Stop propagation and isolate accounts and systems in a controlled way.
When incidents happen, sequence matters.
First understand what is affected. Then contain the issue, preserve evidence and restore services in a controlled way. Here are the questions and responsibilities to settle beforehand.

Emergency Incident Intake
An outage, suspected ransomware, compromised access or critical site disruption first requires a clear assessment of affected systems and impact.
Preserve logs, timelines and relevant artifacts.
Prioritize recovery and use clean recovery points.
Provide management, IT and affected stakeholders with a clear situation report.
This website does not establish a guaranteed response time. Your agreed support or incident contract governs coverage, including any contracted 24/7 service. New enquiries are first assessed for urgency.
The best incident is the one you are prepared for.
- Keep contact and escalation matrix current
- Test restore processes regularly
- Document admin access and break-glass accounts
- Plan communication channels outside compromised systems
