iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
After a company cyberattack, do not start by wiping machines or reconnecting systems. Activate the approved incident-response plan, isolate affected assets, preserve evidence, bring in qualified responders, assess what data and services were affected, meet fact-specific notification duties, and recover only into a clean environment. The sequence below adapts the joint CISA, FBI, NSA and MS-ISAC #StopRansomware Guide (revised October 19, 2023) for broader cyber incidents. That guide focuses on ransomware and data extortion, so your organization’s plan, counsel and incident-response specialists control when its advice conflicts with your situation.
Use this order when an attack is suspected
A cyberattack is both a technical emergency and a governance event. The first decisions can destroy evidence, spread malware or create legal exposure, so assign an incident lead and keep a written timeline from the first credible alert. Record who made each decision, what was known at the time, which systems were affected, and what remains uncertain.
- Activate the incident-response plan and its communications tree.
- Identify affected accounts, devices, applications, subnets and facilities.
- Contain the intrusion without destroying volatile evidence.
- Preserve images, memory, logs, malware and indicators with qualified help.
- Notify internal leaders, your insurer, service providers and government contacts through the plan.
- Determine what data was accessed, changed, copied or made unavailable.
- Eradicate persistence, rebuild from trusted sources and restore in a controlled order.
- Complete a documented review and turn findings into plan changes and exercises.
These are not rigid time boxes. If people are at risk, safety and emergency operations take precedence. Otherwise, use the response plan to balance containment against the business and public services that must remain available.
Recommended Free Tools
1. Activate the incident-response plan and leadership team
Open the organization’s approved incident-response plan at the first credible indication of compromise, not only after the scope is proven. Name one incident commander or equivalent decision owner. That person coordinates technical, legal, communications and operational work while a separate technical lead directs investigation and containment.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Start the communications process
Use pre-approved channels that are not dependent on potentially compromised email or collaboration accounts. Brief senior management at a defined cadence as facts change. Include the people identified in your plan, which may include IT and security, a managed security provider, cyber insurer, legal counsel, communications staff, facilities or safety leaders, and departmental or elected leaders for public organizations.
Keep a single timeline and decision log. Capture alert times, observed indicators, containment actions, systems taken offline, evidence collected, people notified and pending decisions. Preserve original timestamps and identify the time zone. Do not speculate in the log; label hypotheses as hypotheses and update them when investigators confirm or reject them.
Set decision authority and escalation thresholds
Confirm who can authorize network isolation, shutdown of a critical service, outside-forensics engagement, law-enforcement contact, public statements and restoration. Corporate-leader guidance from CISA recommends documented thresholds for reporting incidents to senior management and the U.S. government. Your plan should state those thresholds before an emergency occurs.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →2. Identify and isolate affected systems
Determine which endpoints, servers, cloud workloads, identities, applications and network segments show signs of compromise. Look for unusual authentication, encryption or deletion activity, disabled security tools, suspicious administrator accounts, unexpected remote access, ransom notes, altered backups and traffic to unfamiliar destinations. Treat an unconfirmed but credible signal as a containment problem while responders investigate.
Choose the narrowest isolation that stops spread
Isolate affected devices promptly, but do not assume one disconnected laptop means the incident is contained. If several systems or subnets appear affected, the CISA checklist says taking the network offline at the switch level may be necessary. If that cannot happen immediately, disconnect affected devices from Ethernet and Wi-Fi. Use endpoint, identity, firewall and cloud controls to block malicious accounts and connections when those controls can be applied safely.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
| Containment choice | When it may fit | Main trade-off |
|---|---|---|
| Isolate an individual device or account | Evidence points to a limited asset and lateral movement is not evident. | Preserves more business continuity, but misses an unseen pathway if the scope is wider. |
| Quarantine a server, application or subnet | Related systems share indicators or the attacker is moving laterally. | Stops more spread while interrupting dependent services. |
| Take a wider network segment offline | Multiple subnets, domain services or critical controls are affected. | Strong containment, with potentially severe operational and safety consequences. |
Before a disruptive action, identify dependencies and an alternate communication method. Keep a record of what was disconnected and when. Do not reconnect a device merely to check whether it appears normal.
Protect privileged access
Under the response plan, disable or rotate credentials that investigators identify as exposed, especially privileged, service, remote-access and cloud tokens. Preserve the evidence needed to understand how an account was used before changing it when feasible. If an identity provider or domain controller is suspected, coordinate changes with qualified responders so the attacker is not given a fresh opportunity to retain access.
3. Preserve evidence before it disappears
Containment and evidence collection can conflict. Memory, active network connections, temporary files and short-retention logs may vanish when a machine is powered off or a service is restarted. CISA advises collecting representative system images and memory captures when immediate mitigation is not possible, along with relevant logs, malware samples and indicators. Have qualified responders direct the collection and maintain chain-of-custody records if litigation, insurance or law enforcement may be involved.
Prioritize volatile and short-retention data
- Capture system memory from representative affected systems before shutdown when safely possible.
- Preserve firewall, Windows Security, identity-provider, endpoint, VPN, cloud and application logs before retention windows overwrite them.
- Record active processes, connections, logged-in users and scheduled tasks when responders can do so without altering material evidence.
- Acquire forensic images of representative systems rather than casually browsing or cleaning every device.
- Retain suspicious files, ransom notes, scripts, hashes, domains, IP addresses and other indicators in a controlled evidence repository.
Do not run cleanup utilities, reimage machines or delete attacker files simply to make an alert disappear. If immediate mitigation requires powering down or wiping a system, document why, what was lost and who authorized it. Coordinate with law enforcement when appropriate; investigators can advise on collection and may know of available decryptors for particular ransomware, but no decryptor or successful restoration should be promised.
4. Report and coordinate with the right parties
Follow the notification procedures in the incident-response plan rather than improvising a contact list. Tell the insurer and contracted responders early enough to preserve coverage and access to approved specialists. If a managed security provider, cloud provider or other supplier controls relevant systems, require it to preserve logs and provide an incident contact.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Government reporting for ransomware incidents
For ransomware, CISA’s guide recommends reporting through CISA, a local FBI field office, the FBI Internet Crime Complaint Center (IC3), or a local U.S. Secret Service field office. Verify current agency contacts and submission instructions when you report; contact details can change. The guide describes voluntary federal asset and threat-response support. Reporting does not replace legal notification analysis or your contractual duties.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep one factual message
Limit external statements to verified facts, the services affected, actions being taken and where customers or employees can obtain updates. Avoid naming an attacker, claiming that no data was taken, or stating that systems are fully safe until the investigation supports those conclusions. Route media, customer and employee communications through the designated communications and legal leads.
5. Determine what data and services were affected
Build an impact assessment that distinguishes among data accessed, acquired, altered, encrypted, deleted and merely unavailable. Map affected systems to customers, employees, partners, suppliers and public services. Identify the time period of attacker access, the accounts used, the data stores reachable from those accounts and whether copies left the environment.
Questions the investigation must answer
- Which identities, endpoints, servers, cloud resources and backups were reachable?
- What categories of personal, financial, health, confidential, regulated or proprietary information were present?
- Was data viewed, downloaded, altered, encrypted or destroyed, and what evidence supports each conclusion?
- Which customers, employees, partners, systems and facilities could experience harm or interruption?
- Are safety, essential-service, contractual, regulatory or insurance obligations triggered?
Do not infer that no data was exposed merely because encryption was the visible symptom. Conversely, do not announce exfiltration without evidence. Maintain an uncertainty register showing what is known, unknown and being tested.
6. Determine notification duties with counsel
Breach-notification requirements depend on jurisdiction, sector, data type, contracts and the organization’s legal status. Counsel should apply the facts to the relevant state, territorial, national, sector-specific and contractual rules. CISA’s guidance specifically notes state breach-notification laws and possible Federal Trade Commission or Department of Health and Human Services notification for certain electronic health-information breaches.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
There is no universal reporting deadline that can be stated without those facts. Your legal team should decide who must be notified, the content and timing of notices, whether regulators or law enforcement should be consulted first, and how privilege and evidence preservation will be handled. Technical staff should provide a precise, dated fact record rather than making legal conclusions.
7. Contain, eradicate and investigate with qualified help
Continue the investigation under the plan after the initial quarantine. Find the initial access method, persistence mechanisms, compromised credentials, lateral movement, command-and-control paths and affected backups. Remove unauthorized accounts, scheduled tasks, software, keys and configurations only after responders have captured the evidence needed to understand them.
Decide who should lead technical response
| Responder model | Useful when | Check before authorizing |
|---|---|---|
| Internal security and IT | The team has incident-forensics skills, authority and enough capacity for the scope. | Confirm independence, evidence handling, coverage hours and whether normal operations can continue. |
| Existing managed security provider | The provider already monitors the environment and has response terms. | Verify its authority, log access, escalation times, retention and subcontractor arrangements. |
| Outside incident-response specialist | The attack is broad, regulated, highly technical or beyond internal capacity. | Confirm scope, forensic methods, confidentiality, insurer approval and coordination with counsel and law enforcement. |
These categories are not interchangeable products. Select the people who can access the relevant evidence and make defensible decisions for your environment. Preserve forensic images, memory, logs and indicators when immediate mitigation is not possible. Never represent that a decryption tool exists, that paying or refusing payment guarantees recovery, or that eradication is complete before validation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Restore services in a controlled order
Recovery starts only when responders have a reasonable basis that the entry path and attacker persistence are addressed. Use offline, encrypted backups and prioritize critical services according to the recovery plan. An offline backup is not automatically clean; verify its provenance and scan or test it in an isolated recovery network.
- Define the recovery sequence for essential services, dependencies, authentication and safety functions.
- Establish a recovery network separated from the compromised production environment.
- Choose backup sets created before compromise and validate that they are complete, decryptable and consistent.
- Rebuild or clean systems from trusted images, apply required patches and rotate affected credentials and keys.
- Test restored applications, integrations, logging, security controls and business transactions before production use.
- Reconnect in stages while monitoring for renewed malicious activity and failed controls.
- Record validation results and the person who authorized each system’s return.
Do not restore every system at once for convenience. A single unclean server, reused credential or infected backup can reinfect the recovery environment. An encrypted external hard drive can be one physical backup medium when it fits the organization’s architecture and controls, but it is a preparedness option, not an immediate response remedy.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
9. Communicate throughout recovery
Give employees, customers, suppliers and leaders updates appropriate to their role and the verified facts. Explain which services are unavailable, what users must do, how support can be reached and when the next update is expected. If credentials or personal information may be involved, coordinate protective instructions with counsel and the relevant notification plan.
Keep operational status separate from forensic conclusions. A service may be working while the investigation remains open, and an investigation may be complete while a service still requires rebuilding. Say which condition you mean.
10. Complete the post-incident review
After stabilization, conduct a structured review with technical, operational, legal and leadership participants. Reconstruct the timeline from alerts through restoration, identify where detection or decisions succeeded or failed, and assign owners and due dates for corrective actions.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Turn findings into durable improvements
- Update the incident-response, business-continuity and disaster-recovery plans.
- Correct identity, segmentation, backup, logging, patching and monitoring weaknesses identified by evidence.
- Revise contact lists, escalation thresholds, notification procedures and alternate communications.
- Test restoration from offline encrypted backups and measure whether critical services meet recovery objectives.
- Exercise ransomware, cloud-account and third-party compromise scenarios with leadership.
- Share appropriate indicators of compromise and lessons with CISA or the organization’s sector information-sharing group, subject to legal and contractual review.
Close each action only when its owner supplies evidence, such as a completed configuration change, successful restore test or exercised contact tree. The objective is not a blame narrative; it is a response capability that performs better in the next incident.
Common mistakes that make an attack worse
- Wiping first: Reimaging systems can destroy memory, logs and clues about the initial access path.
- Disconnecting without a plan: A broad shutdown can endanger safety or critical services; map dependencies and record authorization.
- Relying on compromised communications: Attackers may monitor email or collaboration accounts; use an approved alternate channel.
- Assuming encryption proves the full scope: Investigate access and exfiltration separately from availability loss.
- Restoring from the first available backup: Verify that backups predate compromise and are clean before use.
- Promising certainty too soon: “No data was taken,” “we are fully recovered” and “a decryptor will work” are claims that require evidence.
- Waiting to involve specialists: Delayed escalation can allow volatile evidence and short-retention logs to disappear.
- Using a generic legal deadline: Notification timing depends on the affected data, jurisdiction, sector and contracts.
Printable incident-response checklist
- Open the approved plan; name the incident commander and technical lead.
- Move response communications to a trusted channel and start the timeline.
- Identify affected systems, identities, networks, applications and suppliers.
- Isolate individual assets, subnets or the wider network as the risk requires.
- Preserve memory, images, logs, malware and indicators with qualified responders.
- Brief management, insurer, managed providers, counsel and other plan contacts.
- Report ransomware through current CISA, FBI, IC3 or Secret Service channels as appropriate.
- Assess access, acquisition, alteration, encryption, deletion and service impact.
- Have counsel determine notifications and contractual or regulatory duties.
- Eradicate persistence and rebuild from trusted sources.
- Restore critical services from verified offline, encrypted backups in stages.
- Validate, monitor and document each production reconnection.
- Review the incident, assign improvements and exercise the revised plan.
The joint #StopRansomware Guide used for this checklist was developed by CISA with the FBI, NSA and MS-ISAC and lists an October 19, 2023 revision date. Current agency contacts and legal requirements should be verified at the time of an incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
