The first two hours of a cyber crisis

It is common to find fifty-page plans that are of no use when internal email stops going out. The plan does not fail for lack of detail. It fails because no one rehearsed the only question that matters: who decides in the next 120 minutes? The intervals that follow are a working proposal of the author, not a mandatory standard.

What a crisis is not

A technical event is a technical event. It becomes a crisis when it threatens the organisation’s continuity, trust or legality, and when the information available is worse than what the attacker already has. Treating it as a help-desk ticket is the first bad decision.

The four fronts of the first two hours

• Governance: who enters the room, who stays out and who has authority to shut down a production system.
• Containment: what is isolated, what is preserved and what is not touched so as not to destroy evidence.
• Continuity: what minimum operation must remain standing even if the main system does not come back today.
• Communication: what is said inward, what is kept silent outward and who speaks with regulators or clients.

If those four fronts have no owner in the first hour, the organisation will improvise four different narratives. The attacker needs nothing more.

Sequence 0–30, 30–60 and 60–120 minutes

This sequence does not replace the response plan. It orders what cannot wait. Each block has a product, not a meeting.

0–30 minutes: open the room and fix authority

1. Activate the owner of the crisis. If there is no preassigned owner, the CEO assumes until one is named.
2. Open a room —physical or virtual— with a record of time, attendees and a single recorder.
3. Declare the official channel. Everything that happens outside that channel is rumour.
4. Separate containment from investigation. The person who shuts down is not the person who reconstructs the chronology.
5. Protect evidence: do not restart “to see if it comes back”, do not delete logs, do not format “for hygiene”.

30–60 minutes: contain without blinding

1. Isolate what is compromised with a business criterion, not with perimeter panic.
2. Identify systems deliberately left untouched and document why.
3. Estimate, even if roughly, the impact on clients, treasury, regulator and employees.
4. Decide what minimum operation is sustained: payments, critical service, dispatch, payroll.
5. Draft a situation sentence of no more than four lines, with a time.

60–120 minutes: continuity and first communication

1. Confirm who speaks outward. One person. Everyone else redirects.
2. Decide whether there is an obligation to notify and in what timeframe. Legal enters here, not as ornament.
3. Schedule the next decision, with a time. A crisis without a clock becomes a talking shop.
4. List what is still not known and say it as such. Honest emptiness avoids the useful lie.
5. Review whether an internal statement is needed before an external one. Internal rumour is also an incident.

Crisis committee: who enters and who does not

A room, not a chat. The CISO informs. The CEO decides. Legal and communications are not courtesy guests: they are part of governance. Technology executes containment. Continuity says which operation cannot fall. If the chair of the board wants to enter, let them enter to listen, not to rewrite the diagnosis every twenty minutes.

• They enter: owner of the crisis, CISO or equivalent, legal, communications, owner of the critical operation, recorder.
• They enter on demand: insurance, external forensics, regulatory, human resources.
• They stay out: anyone without authority, anyone without information and anyone who only wants to “be in the loop” in a messaging thread.

Decisions that cannot wait

• Is production disconnected now, or is it observed with the risk of further compromise?
• Is evidence preserved even if that delays recovery?
• Is a regulator, a critical client or a supplier notified now, or is the next hour waited for?
• Who has authority to pay, negotiate or refuse a ransom, if the scenario is ransomware?

Checklist of the first 120 minutes

• Owner of the crisis named and present.
• Room open, recorder assigned, single channel.
• Affected systems and untouched systems, in writing.
• Evidence protected: logs, copies, accounts, artefacts.
• Minimum operation defined: what continues, what is stopped.
• Dated situation sentence, of no more than four lines.
• Single spokesperson and list of audiences (internal, clients, regulator, press).
• Next decision scheduled, with a time.

That does not replace forensics. It keeps the board from governing rumours. The first two hours are not won with technical heroism. They are won with judgement. I expand this approach in La próxima crisis no avisará and in the parallel question of what a board should ask about ransomware.

Decision log — hypothetical example

• Time 08:12. Incident declared. Crisis owner: general management. Recorder assigned.
• Time 08:27. Official channel: crisis room. Discussing the incident in parallel chats is prohibited.
• Time 08:41. The mail server is isolated. It is not restarted. Logs are preserved.
• Time 09:10. Minimum operation: treasury and attention to critical clients through an alternate channel.
• Time 09:35. Four-line situation sentence, with a time. Single spokesperson named.
• Time 10:00. Next decision scheduled: whether to notify the regulator, with legal present.

This sequence aligns with the idea of preparation, detection, containment, eradication and recovery that NIST SP 800-61 Rev. 3 describes for incident handling. It does not replace that framework: it translates it into the first two hours of a board.