Executive Cyber Incident Guide: The First 48 Hours

During an incident, most failures are not technical. They are operational: unclear authority, confused communications, missing access, and decisions made without a shared picture. This guide covers what leadership should do and decide in the first 48 hours.

Note: This is general information and not legal advice.

Last reviewed: February 2026

On this page

Executive Summary

What it is

A leadership checklist for coordinating response, communications, and decisions during the first 48 hours.

Why it matters

Time-to-containment is often driven by decisions and coordination, not tools.
Unplanned communication creates risk: misinformation, inconsistent statements, and missed obligations.
Evidence handling mistakes can slow investigation and recovery.

When you need it

You suspect ransomware, business email compromise, account takeover, or vendor compromise.
You have material operational impact (systems down, suspicious admin activity, data exposure concerns).
You are preparing leadership for cyber insurance renewals and customer security reviews.

What good looks like

One incident commander, clear escalation, and a defined decision path.
Communications are controlled, consistent, and documented.
Containment actions are authorized and evidence-preserving.

How N2CON helps

Build an IR plan and playbooks that match your tools and business constraints.
Validate prerequisites (identity, logging, and recovery) so actions are executable.
Run tabletop exercises and convert gaps into a tracked improvement plan.

Executive incident response timeline showing three phases: Hour 0-4 Stabilize, Hour 4-24 Contain, Hour 24-48 Recover — The first 48 hours flow from stabilization through containment to recovery planning

Hour 0-4: Stabilize communications and assign authority

Name an incident commander: one person drives updates and records decisions.
Pick a primary and backup comms channel: assume email may be compromised.
Authorize containment: define what IT can do immediately vs what requires leadership approval.
Start a timeline: capture who did what and when (it becomes evidence).

Hour 4-24: Contain deliberately and preserve evidence

Speed matters, but chaos makes containment harder. Coordinate identity actions, isolation decisions, and evidence handling.

Identity first: revoke sessions, reset credentials, and protect admin access paths.
Log and preserve: confirm what logging exists and keep it safe from deletion or tampering.
Decide on shutdowns: if systems are actively being encrypted or exfiltrated, partial isolation may be required.
Engage counsel and insurance early: align actions with your policy and obligations.

Hour 24-48: Recovery plan, communications, and next decisions

Recovery path: decide whether you are restoring, rebuilding, or operating in a degraded mode.
Communications cadence: schedule internal updates; prepare external statements if needed.
Scope triage: what systems, users, and data types are involved?
After Action Report (AAR): start capturing gaps and owners for fixes.

Related: backup testing and tabletop exercises.

Copy/paste executive checklist

# Executive Cyber Incident Checklist (First 48 Hours)

## First 0-4 hours
- [ ] Assign incident commander and decision approver
- [ ] Choose primary + backup communications channel
- [ ] Confirm containment authority (what IT can do immediately)
- [ ] Start a timeline and decision log
- [ ] Identify key contacts: insurance, legal counsel, critical vendors

## 4-24 hours
- [ ] Confirm identity containment steps (sessions revoked, admins protected)
- [ ] Confirm logging and evidence preservation (no wiping without a plan)
- [ ] Decide on isolation/shutdown actions based on active attacker activity
- [ ] Establish internal update cadence and ownership

## 24-48 hours
- [ ] Choose recovery approach (restore, rebuild, degraded operations)
- [ ] Confirm backup restore feasibility and priorities
- [ ] Determine external communications plan (customers, regulators, partners)
- [ ] Capture gaps and owners for an improvement plan

Related scenarios: ransomware and business email compromise.

Common Questions

What should leadership do first during an incident?

Stabilize communications, assign an incident commander, and make sure containment actions are authorized and executable. The first hours are about coordination, not perfect technical answers.

Should we shut systems down immediately?

Sometimes. It depends on the type of incident and business impact. Your team should have clear containment authority and a decision path for actions that materially impact operations.

When should we contact cyber insurance and legal counsel?

Early. Many policies have requirements about notifications, forensics, and coordination. Your incident response plan should define who makes those calls and how.

How do we avoid making the situation worse?

Avoid improvising access changes or wiping systems without a plan. Preserve evidence, document decisions, and use a coordinated process so actions support investigation and recovery.

Related resources

Sources & References

Need an IR plan, playbooks, and an executive decision path that works after-hours?

We can help build a practical incident response program, validate access and logging, and run a tabletop exercise that produces an improvement plan.

Contact N2CON