By · Updated

Incident Response Checklist

Steps to Contain, Investigate and Report a Ransomware or Data Breach Incident

No ratings yet
Result

—

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the Incident Response Checklist works

This incident response checklist gives you the steps to follow when something goes wrong, in the order they matter. Choose the type of incident and how serious it is to get a numbered list covering preparation, containment, investigation, recovery and reporting, with a box to tick for each.

How to use the incident response checklist

Frameworks such as NIST SP 800-61 split incident response into phases. First you prepare and gather the right people. Then you contain the problem so it stops spreading, investigate what happened, remove the cause, recover systems and finally review what to change. Under pressure it is easy to skip a step, such as keeping evidence, or do them in the wrong order, such as wiping a machine before checking it.

Every checklist starts with the same basics: write things down with times, keep evidence and use a channel the attacker cannot read. The middle steps depend on the incident. Ransomware means isolating machines and checking backups are safe, while a phishing takeover means resetting passwords, revoking sessions and checking mail forwarding rules. A lost device starts with a remote lock and wipe.

High severity adds a step to brief management and bring in outside help. Every list ends with the reporting deadlines check and a lessons-learned review. Use the breach timeline tool to work out the exact reporting dates for your regulator.

Incident response checklist formula

Steps = 1 preparation step + 1 escalation step if severity is High + the steps for the incident type + 3 closing steps

The type steps cover containment, investigation, eradication and recovery. Ransomware has 7, phishing and account takeover 6, malware, lost devices and data leaks 5 each, and denial of service and insider misuse 4 each.

Worked example: high-severity ransomware

1 preparation step, 1 escalation step, 7 ransomware steps and 3 closing steps make 12. The first containment step is to disconnect infected machines but leave them powered on.

Worked example: a lost laptop

1 preparation step, 5 lost-device steps and 3 closing steps make 9 at low or medium severity. The key investigation step is to confirm whether the disk was encrypted.

Incident response reference table

Containment and investigation steps for each incident type.

Incident type Phase Action
Ransomware Containment Disconnect infected machines from the network, but leave them powered on so memory evidence survives.
Ransomware Containment Disable shared drive access and suspend backup jobs so encrypted files do not overwrite good copies.
Ransomware Containment Reset passwords for domain admin and service accounts from a clean machine.
Ransomware Investigation Identify the strain from the ransom note or file extension and check nomoreransom.org for a free decryptor.
Ransomware Investigation Find the entry point, often exposed RDP, a VPN without MFA or a phishing email, and check whether data was copied out first.
Phishing and account takeover Containment Reset the password, revoke all sessions and app tokens, and remove any MFA methods the attacker added.
Phishing and account takeover Containment Delete mailbox rules that forward, hide or delete mail, which attackers add to stay hidden.
Phishing and account takeover Investigation Search the mail system for the same message sent to other staff and pull it from every inbox.
Phishing and account takeover Investigation Review sign-in logs for the account, noting the attacker IPs, and check what files and mail they reached.
Malware infection Containment Isolate the device using your endpoint tool or by pulling the network cable.
Malware infection Investigation Collect the malware sample hash, persistence entries and network connections before cleaning.
Malware infection Investigation Search every other endpoint for the same hash, file names and command and control addresses.
Lost or stolen device Containment Lock and remotely wipe the device through your device management tool.
Lost or stolen device Containment Sign the device out of email, cloud storage and single sign-on, and revoke its certificates.
Lost or stolen device Investigation Confirm whether the disk was encrypted. An encrypted, locked device usually is not a reportable breach.
Lost or stolen device Investigation List the data that was on it, especially personal data held locally rather than in the cloud.
Data leak or exposed data Containment Close the exposure, such as making a storage bucket private or taking a page offline.
Data leak or exposed data Containment Rotate any keys, passwords or tokens that were exposed.
Data leak or exposed data Investigation Use access logs to find out who downloaded the data and for how long it was exposed.
Data leak or exposed data Investigation Work out exactly which records and which fields were exposed and how many people they relate to.
Denial of service Containment Contact your hosting provider or CDN and turn on their DDoS protection or under-attack mode.
Denial of service Containment Rate limit or block the attacking traffic patterns and cache as much content as possible.
Denial of service Investigation Check whether the outage is covering for another attack, such as a login or data theft attempt.
Insider misuse Containment Involve HR and legal before acting, then suspend the person's access across every system at once.
Insider misuse Investigation Preserve logs, mailboxes and devices with a clear chain of custody in case of legal action.
Insider misuse Investigation Review what data the person accessed, downloaded or sent outside the organisation.

Quick answers

FAQ

Should we pay a ransomware demand?

Most authorities advise against it, as payment does not guarantee a working key and funds further attacks. Paying some groups can also break sanctions law. Talk to law enforcement and your insurer first.

Should I turn off an infected computer?

Usually disconnect it from the network instead. Turning it off loses the memory contents that can show what the attacker ran. If files are actively being encrypted, powering off can be the lesser evil.

Who should we tell first?

Start with your incident lead, IT or security team and management. Contact your insurer early, since many policies require it. Regulators, customers and the police follow, based on the deadlines.

Is this a full incident response plan?

No. It is a quick working checklist. A full plan names roles, contacts, systems and decision rights ahead of time. Use these steps as a starting point for writing your own plan and testing it.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

Data Breach Notification Deadline Calculator

Work out the exact deadlines to report a data breach.

Account Security Checklist

A prioritised checklist to secure email, bank, social and work accounts.

CVSS Calculator

Score a vulnerability with CVSS 3.1 from metrics or a vector.

Git Secret Removal Guide

Step-by-step commands to purge a leaked secret from git history.

.env File Checker

Lint a .env file for syntax errors, duplicates and weak secrets.