Incident Response Timeline
Minimal operational steps for the first 72 hours.
AUDIENCE
CHECKLIST
1. I isolated affected account/device.
2. I preserved evidence.
3. I submitted NC4 report and provider alert where needed.
STEP 01
0-15 MIN
Contain and prevent spread
1. Disconnect affected device.
2. Stop sharing credentials.
3. Preserve screenshots and links.
STEP 02
15-60 MIN
Escalate and preserve evidence
1. Record timeline and references.
2. Preserve SMS/email/call logs.
3. Do not delete suspicious artifacts.
STEP 03
1-4 HRS
Report and coordinate
1. Submit NC4 report.
2. Contact provider for financial fraud.
3. Use hotline for urgent escalation.
STEP 04
24-72 HRS
Recover and communicate
1. Reset passwords and enable MFA.
2. Monitor accounts.
3. Warn contacts if needed.