Isolate affected devices
If you can do so safely, disconnect affected devices from Wi-Fi and wired networks. Do not use them to send messages or sign in to other accounts.
Incident Response
Under attack?
Start here.
If you suspect ransomware, a compromised account, or a data exposure, focus first on safety, containment, and preserving what happened. Use this guide to take the next sensible steps.
Email is not a monitored emergency hotline. Contact your IT/security provider and insurer in parallel.
Incident checklist
START NOW01Disconnect affected devices from the network
02Do not power off or delete anything
03Record times, alerts, and affected accounts
04Contact your IT/security team from a safe device
If there is an immediate risk to people or physical safety, follow your organisation's emergency procedures first.
Do This First
While you wait, take these steps.
Avoid actions that could spread the incident or destroy information responders may need. When in doubt, pause and ask your IT or security team.
Do not power off or clean up
Avoid shutting down affected systems, deleting files, running cleanup tools, or changing settings. Those actions can destroy evidence or make recovery harder.
Record what you see
Note the time, affected users and devices, unusual messages, and actions already taken. Photograph screens with a separate device if it is safe.
Use a trusted way to communicate
Contact your IT or security provider from a device you believe is safe. Do not reuse a potentially compromised work email or device to coordinate the response.
The Response
A clear sequence. No guesswork.
Every incident is different. Your responders establish scope and priorities with you before recovery decisions are made.
STEP 01
Triage
Establish what happened, when it began, which systems may be involved, and who is authorised to make decisions.
STEP 02
Contain
Work with your IT or security responders to limit further access and prevent the incident from spreading.
STEP 03
Investigate
Preserve relevant evidence and build a clear timeline of affected accounts, devices, and services.
STEP 04
Recover
Restore systems in a controlled order, verify they are safe to bring back, and keep stakeholders informed.
Common Scenarios
Different incidents. Same calm response.
Ransomware or extortion
Limit network connections from affected devices. Preserve ransom notes and messages, and avoid negotiating or paying before speaking with your response team, insurer, and legal adviser.
Compromised email or account
From a trusted device, notify your IT team and check for suspicious forwarding rules, unexpected sign-ins, or unauthorised changes. Warn colleagues through a separate channel.
Suspected data exposure
Do not delete logs or messages. Record what information may be involved and who may be affected, then involve your privacy lead and legal advisers promptly.
Unexpected outage or system access
Record the affected services and when the disruption began. Keep a note of recent changes, alerts, and supplier communications for your technical team.
Privacy and regulatory notification decisions depend on your circumstances and jurisdiction. Involve your privacy lead and legal advisers; this guide is not legal advice.
Get Ready to Call
What to have ready.
You do not need every answer before you reach out. Share only what you can confirm, using a channel you trust.
Contact us urgentlyUseful information
- A plain-language description of what you noticed and when
- The people, devices, accounts, and services you know are affected
- Any screenshots, alerts, or messages, preserved without altering them
- The name of your IT provider and your cyber-insurance incident contact
- A decision-maker and a safe phone number or email address to reach them
- A way to communicate that does not rely on the affected systems
Set Clear Expectations
Agree scope before anyone acts.
Before a responder accesses systems, agree in writing what they are authorised to do, who the decision-maker is, how updates will be shared, and how costs are handled. Clear authority helps prevent delay and accidental disruption.
The size and duration of an engagement depend on what has been affected and what recovery requires. Ask for a clear scope, the next update point, and any assumptions that still need to be confirmed.
Incident Response FAQ
Questions, answered.
Should we report the incident?
Reporting duties depend on your location, the information involved, and your organisation’s circumstances. Notify your privacy or information officer and legal adviser promptly; they can assess applicable requirements. This page is general information, not legal advice.
Should we turn off affected computers?
Usually, do not power them off unless your incident responder or IT team advises you to, or leaving them connected creates an immediate safety risk. If practical, disconnect them from the network while leaving them powered on.
Can we contact you if we are not an existing client?
Yes. Send us a short description using the urgent contact link and we will confirm whether we can assist. Availability and scope need to be agreed before any hands-on work begins.
How long does incident response take?
There is no reliable one-size-fits-all timeline. A single account issue is different from a widespread outage or ransomware event. The scope becomes clearer as responders establish what was accessed and what needs to be recovered.
Take the Next Step
Need to talk this through?
Send a short note from a safe device. Tell us what you are seeing and how we can reach you. We will confirm whether we can assist and what to do next.
team@novaprotocols.com