News · Academy · November 12, 2026
Academy: the first 24 hours of a cyber incident
Isolate, preserve, call out of band, and know the clocks: 24 hours under NIS2, 72 hours under GDPR, four business days for US listed companies.
DRIVE 369 DAO · 2 min read
Academy, organisations, lesson 2. In the first hours the temptation is to fix things. The first job is to stop the damage and keep the evidence.
The first hour (from CISA's ransomware guide)
The US agency CISA's #StopRansomware guide gives a first-response order that works for most incidents:
- Isolate affected systems. If several networks are hit, take them offline at the switch rather than one machine at a time.
- Coordinate out of band. Use the phone or a channel the attacker cannot read, because your email and chat may be compromised.
- Power down only as a last resort. Powering off destroys volatile evidence in memory.
- Triage for restoration against a list of critical systems you wrote before the incident.
Then collect logs, hunt for how they got in, report, contain, eradicate and recover from clean backups.
Who to tell, and by when
These clocks run from the moment you become aware. Check your own legal advice, because national law adds detail.
| Rule | Clock | Source |
|---|---|---|
| GDPR, personal data breach | Notify the supervisory authority within 72 hours where feasible, unless the breach is unlikely to risk people. A late notice needs reasons. | Art. 33 |
| NIS2, significant incident | Early warning within 24 hours, incident notification within 72 hours, final report within one month. | Art. 23 |
| US listed companies (SEC) | Form 8-K within four business days after deciding the incident is material. | SEC |
| CIRCIA (US critical infrastructure) | Proposed: 72 hours for an incident, 24 hours for a ransom payment. The final rule was not confirmed as published when we checked. | Check the Federal Register |
A one-page plan to write before you need it
- Names and numbers: who leads, who decides, who talks to regulators, customers and press, with phone numbers kept offline.
- A list of critical systems in the order you would restore them.
- An outside responder you can call. The NCSC advises using an assured incident-response firm.
- Where the backups are and who can restore them.
- A rule for staff welfare. Long incidents wear teams out, and tired people make mistakes.
- NIST SP 800-61 Rev 3 (April 2025) maps incident response to the CSF 2.0 functions and is the standard to align with (NIST).
Practise once
A two-hour tabletop exercise, where the team walks through "the host says our servers were breached", finds more gaps than any document.
How Ghostdrive approaches it
The less readable data an attacker finds, the smaller the notification and the harm. Files and AI memory in Ghostdrive are sealed on your device and servers hold ciphertext, which narrows what a server breach exposes. It does not replace a plan or your legal duties.
Academy: start here · Are you already breached? · Backups that survive ransomware