Urgent warning
Do not power off compromised servers or computers immediately if you can avoid it — that can destroy evidence. Isolate them from the network instead, then follow the steps below.
Overview
This guide gives small-business owners a step-by-step framework for the first 72 hours: contain the problem, investigate what happened, then recover safely. It is written for operators — not only for IT teams.
If you need a printable playbook, download the PDF at the end of this page. For non-urgent help, contact support.
First 24 hours: Containment
Isolate affected systems. Disconnect compromised devices from Wi‑Fi and wired networks when safe. Prefer network isolation over immediate power-off so logs and evidence remain available.
Revoke compromised credentials. Reset passwords for affected work accounts through your normal sign-in page. Enable multi-factor authentication where available. Rotate shared mailbox or admin credentials if they may have been exposed.
Alert your team. Tell staff not to click unusual links or approve unexpected MFA prompts. Preserve related emails — do not delete them yet.
Hours 24–48: Investigation
Review available logs: email admin consoles, sign-in history, and hosting or registrar notices. Note when symptoms started and which accounts or devices are involved.
Document findings in writing (who, what, when). Check whether customer data, invoices, or payment details may have been accessed. If a work email appeared in a known leak, treat password reuse as a likely path and reset related accounts.
Hours 48–72: Recovery
Restore clean systems from known-good backups when available. Apply security updates and close the gap that allowed access (exposed admin path, weak email defenses, reused password, etc.).
Confirm MFA is on for critical accounts. Re-check domain email defenses (SPF, DKIM, DMARC) and website public posture after changes. Notify customers or partners only with accurate, approved messaging if their data may be affected.
When to call experts
Contact legal counsel and a qualified incident response professional if sensitive personal data, payment card data, or regulated health information may be exposed — or if you cannot contain the incident.
Cyber insurance policies often require prompt notice. Keep your documentation ready. Identity Defense 247 support can help you interpret monitoring findings; we are not a substitute for legal advice or full forensic response.
Download the PDF playbook
The 72-Hour Incident Response Plan & Playbook is the printable companion to this guide — written for owners, not IT departments.
Still have questions?
Talk to a real person — email, schedule a call, or browse more support options.