Cybersecurity Incident: 7-Step Response Guide for Your Business

1. Introduction

A cybersecurity incident response is not a question of “if it happens”, but “when it happens”. The statistics are stubborn: most companies that suffer a relevant attack do not detect it through their own means, but through a third party: a client who warns them, an insurer who calls or the police showing up at the door. The time between compromise and detection, the so-called dwell time, turns every cybersecurity incident response handled too late into a much bigger invoice. That is why the right question is not how to avoid every cybersecurity incident, but how to build a cybersecurity incident response that works when the incident arrives: orderly, fast and with clear owners.

A company without a response procedure turns a small problem into a crisis. In contrast, a team that knows exactly what to do in the first 24 hours can limit the damage to a scare. The difference is not made by luck: it is made by preparation. In this article we break down cybersecurity incident response into seven steps, with target times, practical commands and the decisions you must make before anything happens.

This guide is aimed at managers and IT leads of SMEs, not forensic technicians: it prioritizes what to decide in each phase and what never to do. Because in cybersecurity incident response, the most expensive mistakes are not technical, they are managerial: destroying evidence, switching off servers without a snapshot or notifying prematurely.

At Jaymon Security we accompany companies throughout the full lifecycle of a cybersecurity incident response, from plan preparation to containment and the forensic analysis that follows. Here is how it works from the inside, step by step.

2. The 7 phases of cybersecurity incident response

The reference model we follow in the industry, aligned with the NIST and ENISA standards, structures management in seven phases with realistic target times for an SME:

Step	Phase	Objective	Target time
1	Detection	Identify the anomaly (alert, warning or finding)	Continuous
2	Triage and classification	Determine scope, severity and owners	< 1 hour
3	Containment	Isolate and stop propagation	< 4 hours
4	Eradication	Remove the threat and the attacker’s access	< 48 hours
5	Recovery	Restore services and verified data	2-7 days
6	Forensic analysis	Evidence, root cause and accountability	1-3 weeks
7	Continuous improvement	Update the plan, controls and training	30 days

Fig. 1 – The seven phases of cybersecurity incident response with their target times.

Not all phases require the same level of urgency, but the sequence is mandatory: skipping containment to start restoring usually re-infects the environment, and deleting evidence during eradication destroys the later analysis. No two cybersecurity incident response cases are identical, but the process must not be improvised. This structure is also what insurers review when they evaluate how you handled the crisis: a cybersecurity incident response managed with method is much easier to compensate than an improvised one.

3. Steps 1 and 2: Detection, triage and classification

Detection starts before the incident: the EDR alerts, the warnings from your monitoring service, the backups that start failing without a reason, or an employee who recognizes the phishing email they just opened. External warnings also count: a client receiving a strange email “from your company” is, in practice, a free detection alarm that many organizations ignore. And cybersecurity incident response often starts at the most unexpected moment: during an audit, a log review or a provider change.

3.1. Triage: the first hour of cybersecurity incident response

The first hour of any cybersecurity incident response determines the final cost. Triage answers three questions: which systems are affected, is sensitive data involved and is the attacker’s access still active? With the answers, severity is classified: low (an unopened phishing email), medium (an isolated compromised endpoint), high (servers or backups encrypted) or critical (data exfiltrated or customer impact). The classification decides who gets notified, what gets switched off and what must be reported, also legally: GDPR requires notifying the authority within 72 hours if personal data is involved.

In this phase the classic mistake is reacting alone: a technician who is “going to take a look” without informing management. Every relevant cybersecurity incident response should activate from minute one a predefined decision channel with three roles: the coordinator, the person who makes economic decisions and the person who talks to the insurer and, if necessary, to the authority. In practice, most corporate cybersecurity incident responses are classified as medium or high: automated attacks rarely produce trivial incidents.

4. Steps 3 and 4: Containment and eradication

Containment pursues a single objective: stop the propagation, even at the cost of sacrificing services. In an active cybersecurity incident, every minute the threat keeps moving across the network increases the final cost. The immediate measures are mechanical and well known, and this is not the moment to discuss SLAs or wait for bureaucratic approvals: containing a cybersecurity incident response means executing the playbook, not improvising it:

# Quick containment: block the compromised host at the firewall
iptables -A FORWARD -s 10.0.1.27 -j DROP

# List suspicious active connections from the affected device
ss -tnp | grep ESTAB | grep -v "192.168.1."

# Reset the compromised account and force a sign-out
pkill -u suspicious_employee
passwd -e suspicious_employee

Fig. 2 – Basic containment commands during a cybersecurity incident response on a compromised endpoint.

Beware of what you should not do: do not switch off the affected device if you are going to hire forensic analysis (powering down destroys the RAM, where the best evidence lives), do not wipe the disk, and do not restore from backups until you have identified the entry vector: if the backup was taken with the door open, the restored door will still be open. The containment phase is guided by one rule: preserve what you might need later.

Eradication consists of removing the attacker’s access: created accounts, backdoors, malicious scheduled tasks, planted SSH keys and the exact persistence mechanism. Eradication is the phase where a professional cybersecurity incident response shows its value: a repeat attacker still inside will turn the recovery into an infinite loop. And a poorly eradicated cybersecurity incident is discovered weeks later, at the next audit or the next attack.

5. Steps 5 and 6: Recovery and forensic analysis

Recovery brings operations back to normal with verified data: restoring from the last clean copies, changing all passwords and keys, validating the integrity of restored files and reopening services gradually. The temptation to “get everything up now” is the enemy: an orderly recovery is worth more than a fast one. Recovery is the phase of cybersecurity incident response where the business feels the impact, and in a case with data encryption it depends almost entirely on the quality of the previous backups.

Forensic analysis, in parallel, answers the questions that cannot wait: what data did the attacker take, how did they get in, from where? Its conclusions feed the legal notification and the insurer’s report, and follow the structure of the CISA incident response playbooks. If the case may end up in court proceedings or a claim, evidence handling has its own rules: forensic image, chain of custody and audited tools.

# First forensic pass over a RAM memory dump
volatility -f memory_compromised.raw windows.pslist
volatility -f memory_compromised.raw windows.netscan

# Inventory of connections and processes with time correlation
log2timeline.py /evidence/inc-2026 timeline.plaso /forensic_image/

# Chain of custody: hash the image before analysing it
sha256sum forensic_image.dd > chain_of_custody.txt

Fig. 3 – Basic forensic commands used in the forensic phase of cybersecurity incident response.

In cybersecurity incident response, a detail few companies know: Windows logs only keep some events for days, and backup retention cycles. If evidence is not preserved in the first 48 hours, the root cause may become unrecoverable. If the case has a possible legal path, evidence preservation is the first obligation, even before cleaning the system. That is why response retainers always include an evidence preservation phase before any cleanup.

6. Step 7: the continuous improvement that closes the loop

The last phase of cybersecurity incident response turns the incident into an advantage: a lessons-learned report, an updated response plan, the closure of the detected vulnerabilities and new tests of the controls that failed. Companies that repeat the same incident mistakes almost always share one pattern: none of them implemented the actions from the previous report. After every managed cybersecurity incident, it is also worth redoing the risk analysis: the assets that failed stop being theoretical.

Prior preparation is what makes the practical difference: having a documented plan, a response retainer with a provider (ideally with a first-response SLA under one hour), verified backups and assigned roles reduces the times in the table to a fraction. At Jaymon Security we design these plans and operate the cybersecurity incident response for companies that do not have their own forensic team, and the first thing we review in any client is precisely the state of those four pieces.

If you want an immediate starting point for your next cybersecurity incident response, this is the minimum checklist we recommend to any SME:

One-page response plan: contacts, roles and the first decision at each severity.
3-2-1 verified backups with a restore tested in the last quarter.
MFA active on remote access and privileged accounts.
Retainer or agreement with a response team reachable 24/7.
Evidence preservation procedure in the first 48 hours.

Fig. 4 – Minimum preparation checklist for incident response in an SME.

7. Conclusion

Cybersecurity incident response is an exam every company will take sooner or later, with preparation as the only variable they can control. The seven phases we have covered —detection, triage, containment, eradication, recovery, forensics and continuous improvement— are the same framework used by professional teams, and applying it with target times is what separates companies that lose days from companies that lose hours.

At Jaymon Security we help companies prepare in advance and respond when it is already too late to prepare: response plans, 24/7 retainers and post-incident forensic analysis. If you want to assess the real state of your cybersecurity incident response readiness, we can start with a no-obligation conversation.

Need help with Cybersecurity incident response?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.