How to build an incident response plan: the first 72 hours

What to do in the first 72 hours of a cyberattack: containment, evidence, notification deadlines in Brazil, the US and the EU, communication and a checklist.

2026-10-01

The clock on a cyber incident starts long before anyone understands what happened. Within 72 hours a company may need to contain the attack, preserve evidence, call its insurer, notify regulators in several countries and talk to customers. NIST's updated incident response guide, SP 800-61 Rev. 3 (April 2025), replaces the 2012 version and ties response to CSF 2.0 risk management (NIST). Its core message: response starts with preparation, not with the alarm. Companies that improvise in the first three days usually lose a deadline, evidence or customer trust, and often all three.

Before: the plan

A named crisis team: security, legal, privacy, communications, finance and executives.
Severity criteria and clear decision rights.
Ready contacts: insurer, counsel, forensics, authorities.
Out-of-band communication channels.
A regulatory map of deadlines by country and sector.
Annual tabletop exercises.

Hours 0–24: contain and preserve

Record when the company became aware; many deadlines run from that moment.
Isolate systems without destroying evidence.
Rotate exposed credentials, privileged ones first.
Notify the insurer before hiring vendors.
Open a time-stamped decision log; regulators and lawyers will ask for it.
Check 4-hour and 24-hour duties under DORA, NIS2 or CIRCIA.

Hours 24–72: assess and notify

Rule	Deadline	Recipient
Brazil LGPD (ANPD Res. 15/2024)	3 business days	ANPD and data subjects
EU GDPR Art. 33	72 hours	Data protection authority
EU NIS2	24h / 72h / 1 month	CSIRT or authority
EU DORA	4h after classification (max 24h) / 72h / 1 month	Financial supervisor
US SEC 8-K Item 1.05	4 business days after materiality	Investors
US CIRCIA (rule pending)	72h incident / 24h ransom payment	CISA
US states	30–60 days in 20 states	Consumers; AG in 36 states

In Brazil, ANPD Resolution 15/2024 counts three business days from awareness that personal data were affected, doubled for small agents, with 20 business days to supplement and five-year record keeping (Cescon Barrieu). Under the GDPR, authorities must be notified within 72 hours unless the breach is unlikely to create risk, and every breach must be documented (AEPD). NIS2 requires a 24-hour early warning (Freshfields); DORA an initial notice within 4 hours of classification (FMA).

In the US, listed companies file an 8-K within four business days of determining materiality, with a possible Attorney General delay (Hunton). CIRCIA's final rule was under White House review in October 2026 (Paubox). Twenty states set 30-to-60-day consumer deadlines (Privacy Rights Clearinghouse). For ransomware, OFAC treats prompt reporting and cooperation as significant mitigating factors (OFAC).

Communication

Legal notices and public messaging must tell the same story. Inconsistent statements to regulators, customers and the press are a common source of later liability.

Speak early, with confirmed facts only, and avoid speculating about cause or attribution.
Align statements with counsel and insurer.
Tell customers what to do: change passwords, watch accounts, distrust unexpected contacts.
Prepare spokespeople and a call-centre FAQ.
Brief employees before the press.
Update on a predictable schedule.

72-hour checklist

Awareness time logged.
Systems isolated, evidence preserved.
Insurer and counsel engaged.
Deadlines mapped and notices sent.
Public and internal messages approved.