Don't Power It Down: What the First Hour of a Cyber Incident Requires

The first hour of a cyber incident isn't about stopping the attacker, cleaning up the mess, or getting back online. Those come later, and rushing them is how people make the next six months worse.

The first hour is about evidence preservation and containment: cutting off the attacker's access while keeping intact the record of what they did. Everything you'll need afterward - the forensic investigation, the insurance claim, the notification decisions, the answer to "when did you know" - depends on a record that the obvious instincts destroy.

The obvious instincts are: turn it off, delete the bad thing, and clean it up. All three are wrong, and the first one is the most expensive.

Why is powering down the wrong move?

Because a running computer holds evidence that a stopped one doesn't.

NIST puts it directly in SP 800-86, *Guide to Integrating Forensic Techniques into Incident Response*: "Volatile data refers to data on a live system that is lost after a computer is powered down or due to the passage of time." The document adds that "in many cases, acquiring volatile data should be given priority over non-volatile data."

What's in there matters. Active network connections showing where the attacker came from and what they're talking to. Running processes, including the attacker's own tools, which frequently never touch disk. Login sessions. Open files. Memory-resident malware that leaves nothing behind on the hard drive at all. Hit the power button and that entire layer is gone permanently, and no amount of later analysis brings it back.

Disconnecting from the network solves the actual problem - the attacker loses access - without solving it by destruction. CISA's Ransomware Response Checklist makes the priority explicit: "Determine which systems were impacted, and immediately isolate them," and then, as the fallback, "Only in the event you are unable to disconnect devices from the network, power them down to avoid further spread of the ransomware infection." The checklist notes that powering down sacrifices "ransomware infection artifacts and potential evidence stored in volatile memory."

Isolate first, and power down only when you can't isolate. That's the rule, and it's the opposite of what almost everyone does.

The mechanics are unglamorous. Unplug the ethernet cable. Turn off Wi-Fi. If a lot of machines are affected, take the network offline at the switch. Leave the machines running.

What else does the first hour require?

Five things, in rough order, and none of them involve fixing anything.

1. Isolate the affected systems from the network. Cable out, Wi-Fi off, machines still running. Switch-level if the spread is wide.
2. Preserve everything. Don't delete suspicious files or emails - they're the evidence. Don't wipe or reimage. CISA's checklist also calls for taking "a system image and memory capture of a sample of affected devices" and collecting relevant logs, which is DFIR work, but the part you control is not destroying the source material before somebody arrives to capture it.
3. Write down what you saw and when you saw it. Times, systems, symptoms, who noticed what. This timeline becomes the backbone of the investigation, the insurance claim, and every notification decision that follows. Written during is worth ten times reconstructed after.
4. Move your communications off the possibly-compromised system. If the attacker is in your email, planning your response in that email tells them your next move. Use phone calls or a device you know is clean.
5. Call for guidance before you act further. Specifically before you pay, reply to, or negotiate with anyone.

Notice what isn't on that list: restoring from backup, rebuilding servers, changing every password, or issuing a statement. All of those are real tasks. None of them belongs in the first hour, and doing them early can contaminate the thing you'll need later.

Should you pay a ransom?

Don't decide that alone, and don't decide it first.

The FBI's published position is unambiguous and worth quoting exactly, because people paraphrase it into something stronger than it says: "The FBI does not support paying a ransom in response to a ransomware attack. Paying a ransom doesn't guarantee you or your organization will get any data back. It also encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity" (FBI IC3).

Read that carefully. "Does not support" is not "prohibits." The FBI discourages payment. It does not make it illegal.

Sanctions are a separate and sharper issue. Treasury's Office of Foreign Assets Control published an Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments on September 21, 2021, and it remains the operative guidance. Its central point is strict liability: "OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if such person did not know or have reason to know that it was engaging in a transaction that was prohibited."

The advisory also names what helps. OFAC will treat a company's "self-initiated and complete report of a ransomware attack to law enforcement" as a voluntary self-disclosure and "a significant mitigating factor," along with full cooperation during and after. And its exposure reaches beyond the victim - to insurers, DFIR firms, and payment processors that touch the transaction.

So the payment question isn't one you answer in the first hour. It's one you answer with a response team, your carrier, and counsel in the room, after you know what actually happened.

Who do you have to notify, and when does the clock start?

It depends on what data was involved and where the affected people live, and the deadlines are shorter than most people assume.

Florida gives you 30 days. F.S. 501.171(4)(a) requires notice to affected individuals "as expeditiously as practicable and without unreasonable delay... but no later than 30 days after the determination of a breach." Breaches affecting 500 or more Florida individuals also require notice to the Department of Legal Affairs within 30 days, with a 15-day extension available for good cause. More than 1,000 individuals at once adds notice to the consumer reporting agencies.

The FTC Safeguards Rule adds its own. 16 CFR 314.4(j) requires that if a notification event "involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery." That applies to a much wider set of businesses than most realize - see our page on the FTC Safeguards Rule for who counts as a financial institution.

Sector rules stack on top. HIPAA and PCI DSS each carry their own obligations with their own timelines and their own triggers.

Every one of those clocks runs on a determination you can only make if the evidence survived. That's the whole argument for the first hour in one sentence: notification decisions are downstream of forensics, and forensics are downstream of not destroying the machine.