The first 72 hours of incident response: a checklist for small teams

The first 72 hours after a cyber incident usually define the cost, speed, and confidence of the entire recovery effort. Small teams do not need a huge playbook on day one. They need a sequence that protects operations and avoids improvisation under pressure. What to prioritise immediately Confirm whether the incident is still active and isolate affected systems quickly. Preserve logs, screenshots, alerts, and admin actions from the first minutes. Limit internal communication to a defined response group and clear decision owner. Stop risky changes that could destroy evidence or widen impact. Stabilise the business, not only the machines An incident response plan should always answer three business questions early: which services are interrupted, which customers are affected, and what deadline matters next. That framing prevents technical work from drifting away from operational priorities. By the end of the first 72 hours, the goal is not to know everything. The goal is to know enough to contain the problem, communicate responsibly, and move into recovery with evidence intact.