Incident Response | CyberStackHub

Q: What is the first thing I should do during a cybersecurity incident?

Immediately contain the affected systems: disconnect impacted devices from the network, revoke compromised credentials, and preserve logs before they are overwritten. Do not reboot affected machines — forensic evidence is often lost on reboot. Once contained, activate your incident response plan and notify key stakeholders within the first hour.

Q: When do I need to notify regulators or customers after a breach?

Notification timelines depend on your jurisdiction and the type of data involved. GDPR requires notification to supervisory authorities within 72 hours of discovering a personal data breach. HIPAA requires covered entities to notify HHS and affected individuals within 60 days. Most US states have breach notification laws requiring customer notification within 30–90 days. Consult legal counsel promptly — penalties for missing deadlines can exceed the cost of the breach itself.

Q: What should be in an incident response plan for an SMB?

An effective SMB incident response plan covers six phases: Preparation (contact lists, tool inventory, backup verification), Identification (detecting and confirming the incident), Containment (isolating affected systems), Eradication (removing the threat), Recovery (restoring systems from clean backups), and Post-Incident Review (root cause analysis and gap remediation). The plan should assign specific roles, include vendor contacts for cyber insurance, legal counsel, and a forensic firm, and be tested annually with a tabletop exercise.

Q: Does cyber insurance cover all incident response costs?

Most cyber insurance policies cover forensic investigation, legal notification, credit monitoring for affected individuals, business interruption losses, and ransomware payments (subject to policy limits). However, 40% of claims are denied, most commonly for failure to maintain required security controls like MFA. Review your policy carefully before an incident — coverage gaps are discovered at the worst possible time.

CyberStackHub

🚨

We Think We've Been Breached.

Don't panic. We'll walk you through exactly what to do — step by step, right now.

or

View Past Incidents

Incident Declaration

Answer a few quick questions so we can build your personalized response playbook.

Company Name *

Industry

Company Size

What happened? *

When did you discover this?

Which systems are affected?

What type of data may be involved?

Estimated number of affected users/customers

Review Your Declaration

What happens next:

We'll classify your incident type, assign a severity level, and generate a step-by-step containment playbook with a notification checklist — all in about 15 seconds.

Analyzing your incident...

Classifying incident type and severity...

Time Since Declaration

0:00:00

Response Progress 0%

SEEK EXPERT ADVICE

This playbook is AI-generated guidance. Contact qualified legal counsel, a cybersecurity incident response firm, and your insurance carrier before taking actions that may have legal or regulatory implications.

Required notifications based on your compliance obligations and incident type. Check off each one as you send it. Deadlines are countdown from incident declaration.

+ Log an Action

Post-Incident Review

Root Cause

Lessons Learned

Remediation Action Items

Incident Timeline Summary