0-15 min · Contain and prevent spread
- Citizen / Individual: Disconnect affected device. Stop sharing credentials. Preserve screenshots and links.
- Organization: Isolate infected endpoint/session. Disable compromised accounts. Block malicious domains/IPs.
- CII / Essential Service: Activate incident command. Isolate impacted segment safely. Increase SOC monitoring.
15-60 min · Escalate and preserve evidence
- Citizen / Individual: Record timeline and references. Preserve SMS/email/call logs. Do not delete suspicious artifacts.
- Organization: Assign incident lead. Freeze logs and traces. Notify internal executive/legal owner.
- CII / Essential Service: Notify regulator/internal crisis team. Capture continuity impact. Prepare NC4 status update.
1-4 hrs · Report and coordinate
- Citizen / Individual: Submit NC4 report. Contact provider for financial fraud. Use hotline for urgent escalation.
- Organization: Submit scope and containment status. Share attack vector and affected assets. Provide accountable contacts.
- CII / Essential Service: Submit priority report. Include critical service impact. Maintain regular updates.
24-72 hrs · Recover and communicate
- Citizen / Individual: Reset passwords and enable MFA. Monitor accounts. Warn contacts if needed.
- Organization: Restore services in phases. Issue user safety communication. Perform post-incident review.
- CII / Essential Service: Validate restoration integrity. Issue regulator-aligned summary. Track corrective actions to closure.
Checklist · Citizen / Individual
- I isolated affected account/device.
- I preserved evidence.
- I submitted NC4 report and provider alert where needed.
Checklist · Organization
- Containment owner assigned.
- Evidence preservation confirmed.
- NC4 report submitted with impact summary.
Checklist · CII / Essential Service
- Crisis governance activated.
- Continuity risk assessed.
- NC4/regulator notification initiated.