Chapter 5 of 14 · Any time, often sooner than you think
Your First Incident: What If I Screw Up?
- What if I make the wrong call in my first incident?
- What should I do in the first 24 hours?
- How do we review it without blaming someone?
Your first real incident will probably come before you feel ready. That is fine. Nobody is judged on whether they knew everything. People are judged on whether they stayed calm, made clear decisions and told the right people at the right time.
The question you might not ask out loud
What if I screw it up?
You will get some things wrong. Every incident lead does. What matters is that each decision was reasonable with what you knew at the time, and that you wrote down what you knew and why you chose. Decisions you can explain are survivable. Silence and guessing are not.
The first 24 hours
- Name an incident lead. It does not have to be you. It does have to be one person.
- Write down what you know, what you do not know and the time. Keep doing this every hour.
- Contain before you investigate in depth. Stop the spread first.
- Preserve evidence. Do not wipe and rebuild before someone has captured what is needed.
- Tell legal early. They decide what must be reported and when. You give them facts.
- Agree who speaks to staff, customers and the press. Nobody else does.
- Set the next check-in time before each meeting ends.
If your company is listed in the United States, there is a clock to know about. The SEC requires a company to decide whether an incident is material without unreasonable delay after discovery, and if it is material, to file a Form 8-K under Item 1.05 generally within four business days of that decision. The clock runs from the materiality decision, not from the attack. Make sure you know who makes that decision before you need it.
Rule of thumb:Write it down as you go. Memory after a long night is not evidence, and it is not kind to you either.
The blameless review
A week or two after, hold a review. The aim is to learn how the system let this happen, not to find a person to punish. People who fear blame hide mistakes, and hidden mistakes come back bigger.
- Ask "what made this the reasonable thing to do at the time?" rather than "why did you do that?"
- Look for the conditions: missing alerts, unclear owners, tired people, confusing tools.
- End with a short list of changes, each with an owner and a date.
- Share what you learned more widely than feels comfortable.
Blameless does not mean consequence-free. Someone who deliberately ignored a rule is a different case. But that is rare, and treating every mistake as if it were deliberate guarantees you will hear about fewer of them.