Incident response reflexes

When a cyberattack hits, the first minutes decide how bad it gets. The Incident response reflexes document is a short, printable guide that tells you what to do, and what never to do, in the moments before the Stoïk CERT takes over the technical response.

It covers the reflexes common to every incident, then the specific first actions for the main attack types: ransomware, wire transfer fraud (BEC), data breach, DDoS, and account compromise.

Download the document: the Incident response reflexes guide is available in Word (.docx), in English, French, German, Dutch and Spanish, on our drive: Incident response reflexes on Google Drive

The 3 golden rules

Taken from the document, these apply to every incident:

• Stay calm. Rushed decisions almost always make the situation worse.

• Call the Stoïk CERT before any technical action or external communication.

• Document everything: time, systems affected, actions already taken.

Why download it

• The actions you take in the first hour shape the entire recovery. They need to be ready, not improvised under pressure.

• During a real attack your systems may be down or untrusted. A guide you have already read, and ideally printed, is one you can still use.

• It speeds up the call with the CERT: you already know what to isolate, preserve, and report.

What to do with it

1. Download it and read it before any incident, not during one.

2. Share it with the people who would handle a crisis: IT, management, finance.

3. Keep an offline copy, the same way you keep your BCP/DRP plan.