INCIDENT RESPONSERead by role

Suspect a ransomware attack? Start with your role

Different roles have different tasks in the same incident. Choose the edition appropriate to you and confirm current actions and handover information.

Compiled with SI agent assistance · Official information checked2026.10.26
Contain the spread first, then coordinate investigation and recovery

Notify the incident owner and first have authorised personnel isolate affected devices from the network. Consider shutting down to prevent spread only when network access cannot be suspended or the affected host cannot otherwise be disconnected; shutdown loses memory evidence. Do not reinstall or delete files yourself. For equipment affecting physical safety, assess shutdown under existing emergency procedures.

YOUR ROLE / Your tasks

Management Version

Prioritise people and critical services, assigning owners and recording decisions for shutdowns, notifications and recovery.

Management and operations colleagues at a Hong Kong SME meeting table organise incident priorities and recovery arrangements
Original composite illustration assisted by an SI agent · Illustrative scene About this image ↗
  1. 01

    Activate Incident Command

    Appoint one incident owner and bring together IT, cybersecurity, business and relevant support staff. Switch to a communication method confirmed to be safe, and record who may approve downtime, expenditure and external statements.

  2. 02

    Set Business Priorities

    List interrupted services, affected customers and feasible manual alternatives. Have the technical team explain the risks of continued operation before deciding which services to pause and which to restore first.

  3. 03

    Arrange notifications and support

    Have the appropriate owners confirm notification arrangements based on location, contracts and data types, and appoint one external point of contact. Clearly separate verified facts, open questions and the time of the next update.

  4. 04

    Approve Phased Recovery

    Require the team to confirm the entry point, backup availability and recovery environment before approving the gradual reopening of services. Preserve ransom demands on receipt; payment is not a guarantee of restored service.

What to Include in a Handover

Brief technical and investigation teams on the incident owner, critical service priorities, acceptable downtime impact, resource authorisation and external point of contact.

YOUR ROLE / Your tasks

IT edition

With authorisation, isolate the affected environment, preserve investigative evidence and restore services in a clean environment.

IT response illustration: an isolated laptop, network equipment and a backup drive stored separately
Original composite illustration assisted by an SI agent · Illustrative scene About this image ↗
  1. 01

    Confirm Scope and Isolate

    Record devices, accounts and the time first detected. Have authorised personnel isolate affected devices from the network and check connected servers and cloud services. Do not reconnect suspicious backups to a clean network.

  2. 02

    Preserve evidence before cleaning up

    Preserve ransom messages, alerts, login and system logs, and record actions already taken. Do not begin by reinstalling, deleting files or repeatedly rebooting. Have cybersecurity specialists arrange memory or disk forensics where needed.

  3. 03

    Address abused access

    Coordinate with the incident lead to disable affected accounts, revoke sessions and rotate keys. Work from a clean administration device, inventory remote entry points and permissions, and do not treat a single password change as a complete response.

  4. 04

    Test recovery in an isolated environment

    Check backup times and signs of compromise, then test restoration in isolation. Confirm necessary patches, access restrictions and monitoring before restoring in the approved order, watching for renewed anomalies.

What to Include in a Handover

Provide cybersecurity specialists with: device and account inventories, times and time zones, log locations, isolation actions, backup status and dependent services still requiring attention.

YOUR ROLE / Your tasks

Cybersecurity Specialist Version

Separate assumptions from evidence and coordinate technical work for containment, investigation and recovery.

Cybersecurity specialists examine affected storage devices at a forensic workbench and record investigative leads
Original composite illustration assisted by an SI agent · Illustrative scene About this image ↗
  1. 01

    Build an incident timeline

    Correlate endpoint, identity, network and cloud logs to examine initial entry, privilege escalation, lateral movement and data exfiltration. Record confirmed scope separately from hypotheses still requiring verification.

  2. 02

    Arrange Evidence Preservation

    Acquire memory or disk images according to authorisation and case requirements. Preserve originals and analyse copies. Record the collector, time, tools and hashes to maintain chain of custody. Balance collection order against the risk of continued spread.

  3. 03

    Contain and Remove Persistent Access

    Coordinate with IT on network segmentation, account and key revocation, malicious persistence and vulnerability patching. Adjust detection and hunting scope based on evidence; do not attribute an attacker solely from one IP address, filename or ransomware name.

  4. 04

    Verify Recovery and Compile the Report

    Define technical conditions for service restoration, verify backups and clean rebuild environments, and arrange post-recovery monitoring. Hand over the scope, root cause, response records, unresolved issues and improvements, with the required security evidence.

What to Include in a Handover

Provide management and authorised investigators with the technical timeline, evidence index, confirmed impact, confidence levels, and containment and recovery recommendations. Send sensitive information through agreed channels.

YOUR ROLE / Your tasks

Law enforcement edition

Case information and handover priorities for authorised personnel. Specific investigations should follow the relevant agency's procedures and applicable law.

Case handover illustration: business representatives and investigators checking sealed devices and evidence handover records
Original composite illustration assisted by an SI agent · Illustrative scene About this image ↗
  1. 01

    Clarify the case and contacts

    Record the reporting party, contact person, incident time, affected locations and business impact. Distinguish the victim's account, technical observations and verified evidence, and clarify jurisdiction and authority to obtain data.

  2. 02

    Create an evidence inventory and handover record

    Receive ransom messages, communications records, account and system evidence, transaction identifiers and technical reports as needed. Record each item's source, acquisition method, time, hash and handover person. Preserve originals and control access.

  3. 03

    Coordinate Preservation with the Response Team

    Specify early which logs, devices and data need preserving, and coordinate service recovery with evidence preservation. Clearly record isolation or remediation actions taken before collection. Do not ask untrained staff to perform high-risk forensic work themselves.

  4. 04

    Follow up through official channels

    Follow agency procedures when contacting service providers, authorities in other jurisdictions and relevant parties. Give the reporting party case contact arrangements and requests for additional information, without guaranteeing arrests, decryption, fund recovery or outcomes.

What to Include in a Handover

When receiving or handing over evidence, confirm: case identification, the provider's authority, evidence inventory, custody and handover records, restrictions and the next responsible person.

Official References and Support

The four versions are educational material organised by role, not official law enforcement procedures. HKCERT security incident support and reporting to the police are separate channels; giving information to one does not complete the other's process. Refer to official pages for each organisation's remit and contact arrangements.

Open Incident Follow-Up Checklist ↗

All guides ←