Build a first-hour checklist for a suspected attack

Write a one-page checklist for the first 60 minutes after someone suspects ransomware at our organization.

- Identity provider: [Active Directory / Entra ID / Okta]
- Backup product: [Product]
- Environment: [On-prem / Cloud / Hybrid]
- Incident response retainer: [Firm name, or "none"]
- Cyber insurance: [Yes / No]
- We handle CUI or federal contract data: [Yes / No]

Order it by minute (0-5, 5-15, 15-30, 30-60). For each step, say who does it and what not to do: for example, isolate affected machines from the network but don't power them off, don't start restoring yet, and don't discuss the incident over email or chat on systems that may be compromised.

Include how to protect the backups before anything else, and who to call, in order, with blanks for phone numbers. If we have cyber insurance, put the insurer's breach hotline before any outside firm, since many policies only pay for their approved vendors. If we handle CUI, include the 72-hour DFARS reporting clock. Keep it to one printed page.

Some details above are still in square brackets. Ask me for them before you answer, rather than guessing.