Skip to main content
Edge SecureSECURE IT · PRIVATE AI · FASTER BUSINESS
Incident Preparedness Guide

Preparing for a Cybersecurity Incident

The steps to take before, during, and after a security event — written for business owners, not IT professionals.

8 min read · Last reviewed July 2026

Note: This guide provides general preparedness education. During an active security incident, contact a qualified incident response professional or your managed security provider immediately. Do not attempt to investigate or remediate a significant breach without professional guidance — improper handling can destroy evidence and worsen the outcome.

Before an incident: preparation

Plan incident response before systems are disrupted. The preparation steps below can help your team coordinate containment, evidence preservation, and recovery; outcomes depend on the incident and your environment.

Know who to call

Before an incident, identify: your IT or managed security provider's emergency number, your cyber insurance carrier's claims hotline, legal counsel familiar with breach notification law, and a public communications contact (if clients or press may need to be notified). Write these down and store them somewhere accessible — not only on the systems you might lose.

Review your cyber insurance policy now

Many policy holders discover their coverage gaps during a claim. Read your policy to understand: what types of incidents are covered, whether there are notification time requirements, what the coverage limits are, and what security controls were required as a condition of coverage.

Document your critical systems

Know what systems are critical, where your data lives, and what your recovery priorities are. This documentation should be stored offline or in a separate, secure location.

Establish breach notification obligations

Depending on your industry and location, you may be legally required to notify employees, clients, regulators, or the public within a specific time frame after a breach. Know these requirements before you need them.

Test your backups

This is preparation for the recovery phase of an incident. Knowing your backup is working before an incident is far better than discovering it isn't during one.

During an incident: immediate steps

If you suspect ransomware, a major breach, or active attacker access — call your incident response contact immediately before taking other steps.

1

Contain — don't clean

Isolate affected systems from the network if possible, but do not wipe or reinstall them. Forensic investigation requires the original state of affected systems. Premature cleanup can destroy evidence needed for investigation or an insurance claim. Coordinate containment and preservation with the incident lead.

2

Document what you observe

Write down exactly what you noticed, when, and what happened. Take screenshots where safe to do so. This timeline is essential for both investigation and any regulatory notifications.

3

Change credentials from a clean device

If account compromise is suspected, change passwords from a device you're confident is not compromised — not the affected system. Contact your IT provider before doing this if you're unsure.

4

Notify your IT or security provider

This is not the time to investigate yourself unless you have professional incident response experience. Your managed security provider or an incident response firm should lead the technical investigation.

5

Contact your insurance carrier early

Check your policy for notification requirements and approved response providers. Contact your carrier as soon as you suspect a covered incident — even before you know the full scope.

After an incident: recovery and review

Restore from clean backups

Work with your IT provider to restore systems from backups that predate the incident. Verify that backups are clean before restoration — ransomware can lay dormant in backup copies.

Complete breach notifications if required

Work with legal counsel to determine whether and how to notify affected parties. Notification requirements vary by state, industry, and the type of data involved.

Conduct a post-incident review

After recovery, review how the incident occurred, what controls failed, what gaps exist, and what was handled well. This review drives the changes that reduce the risk of recurrence.

Update your incident response plan

Every incident teaches something. The response plan should be updated based on what was learned — including contact information, process gaps, and recovery steps that didn't work as expected.

Primary sources and scope

These sources support the specific regulatory, provider, or recovery distinctions discussed here, not a complete compliance assessment or a guarantee of results. Confirm applicability, current terms, and your actual configuration before acting.

Related Tools and Resources

ToolCybersecurity Risk AssessmentToolBackup Readiness AssessmentServiceCybersecurity Services

Ready for a professional review of your current situation?

Request a Cybersecurity Risk Review

Edge Secure / Privacy

Your privacy, simply.

We’d like to use Google Analytics to improve this site and understand what leads to an inquiry. Optional analytics measures page views, referrers, tool starts and completions, contact-button clicks, and accepted inquiries—not your form answers. No advertising tracking.

Your local tool history still works either way. Change or withdraw your choice anytime in Privacy settings. Closing changes nothing.