ISO 27001 A.5.26: Response to information security incidents

When an incident is declared, activate the response plan. Assign an incident manager as the single point of coordination and accountability. Open a case in your incident tracking system and start logging everything.

Contain first. Stop the bleeding - isolate affected systems, block malicious IPs, disable compromised accounts, segment the network. Distinguish between short-term containment (immediate emergency actions) and long-term containment (sustainable measures while you prepare eradication).

Investigate in parallel with containment. Collect and preserve evidence following forensic best practices. Determine scope: what systems and data are affected, how the attacker got in, when the initial compromise occurred, and whether data has been exfiltrated. Use forensic tools appropriate to the incident type.

Eradicate the root cause. Remove malware, patch the vulnerability that was exploited, reset compromised credentials, rebuild affected systems if necessary. Do not cut corners here - verify that all indicators of compromise have been addressed before moving on.

Recover methodically. Verify restored systems are clean and functional before putting them back into production. Monitor closely for signs of re-compromise. Communicate realistic restoration timelines to stakeholders.

Manage communications throughout. Keep management and affected teams informed internally. Externally, you may need to notify customers, partners, and regulators. GDPR Article 33 gives you 72 hours for supervisory authority notification. Use pre-drafted templates to save time under pressure.