Stabilise without destroying the evidence
Delete nothing, do not reinstall. Write down the facts, the times and take screenshots. What looks like a detail today may be the only usable trace tomorrow, for you, your insurer and the regulator.
Incident management · crisis in progress
Cyber incident in progress: contact the crisis team.
Ransomware, compromised administrator account, data leak, payment fraud or critical outage: call 09 73 37 47 16 Monday to Friday between 8 am and 7 pm, Saturday between 8 am and 12 noon. Before any reset or deletion, keep whatever material is available and write down the actions already taken.
Emergency line Monday to Friday from 8 am to 7 pm, Saturday from 8 am to 12 noon (Paris time). In immediate danger: dial 17 (police) or 112.
Hosted in France with Scaleway · Mistral AI (EU) · we will never ask you for your passwords or your codes.
01 · THE FIRST 3 STEPS
Before any irreversible action, three reflexes
The right first decision costs nothing and protects everything else. Take these three steps before erasing, reinstalling or communicating.
Isolate, without blinding what comes next
Cutting off too fast can stop the business and make useful material disappear. Isolate the systems concerned and secure privileged access, in proportion to the scope and to the possible spread.
Call and open the cell
Explain the situation before acting alone on partial information. Galyct Pro opens a crisis cell, brings the roles together and keeps the decision log, so that everyone decides at the right level.
02 · WARNING SIGNS
When the situation must be handled as a crisis
A cyber crisis does not always start with visible ransomware. It can begin with a weak signal, a business inconsistency or an alert from a provider.
Compromised critical account
Administrator, management, finance, email, cloud, VPN, business application or provider account with privileges.
Fraud or suspicious transfer
Fake bank details, change of bank details, supplier impersonation, urgent order or approval under pressure.
Data leak or exposure
Customer documents, HR data, health data, contracts, personal data, trade secrets or files placed beyond your control.
Abnormal activity on the information system
EDR alerts, unusual logins, unknown scripts, accounts created, mail rules or abnormal network volume.
Business outage
Critical tool blocked, production stopped, invoicing unavailable, customer portal affected or essential provider failing.
External pressure
Ransom demand, threat of disclosure, media enquiry, worried customer, demanding insurer, authority or main contractor.
03 · THE CRISIS CELL
Linking the technical, the legal, the business and reputation
Galyct Pro structures coordination so that no one makes an isolated decision on partial information. One cell, defined roles, a timestamped, exportable log.
Management
Trade-offs, continuity, budgets and strategic exposure: the decisions that belong to management alone.
IT / security
Technical scope, access, logs and containment: contain without erasing what is still to be understood.
DPO / legal
Personal data, notification, evidence and contracts: qualify the obligation with the right level of certainty.
Business units
Critical processes, customers, production and priorities on the ground: what must hold at all costs.
Communication
Internal messages, customers, partners and public stance: say the right thing, at the right time, without contradicting yourself.
Insurance / providers
Claims, scope of intervention and traceability: a file that is kept up, transferable and consistent.
04 · WHAT WE DO NOT PROMISE
Even in an emergency, we do not promise the impossible
Serious crisis management rests on careful qualification, traceable facts and a clear distinction between finding, hypothesis and decision.
No guaranteed result
The aim is to stabilise and reduce exposure, not to guarantee that an incident is impossible. Recovery depends on backups, the scope affected and the actual state of the information system.
Never your passwords or your codes
Galyct Pro never needs your credentials, your codes or your means of payment to support you. Any request of that kind should put you on alert.
No hasty attribution
Identifying a perpetrator or a group requires solid evidence. A hypothesis must not become a certainty: what cannot be demonstrated is presented as such.
No automated legal decision
Notification, filing a complaint, external communication or activating insurance are qualified with the competent contacts. Galyct Pro helps to structure, document and steer; it replaces neither a CERT, nor a lawyer, nor an authority.
05 · THE FIRST HOURS
An operational timeline that management can read
An indicative guide, to be adapted to the nature of the incident and to the applicable obligations. The guiding thread stays the same: preserve what will make it possible to understand, then decide without losing control.
01PreserveLogs, screenshots, decisions and timestamps before any irreversible action.
02QualifyFacts, scope, data, exposed accounts; distinguish facts, hypotheses and weak signals.
03IsolateIsolate the systems concerned and secure privileged access, proportionately.
04Open the cellBring the roles together, record communications, keep the decision log.
05DecideContinuity, notification, communication, remediation: decide even without a complete analysis.
06StabiliseCheck the backups, consolidate, track the indicators and prepare the lessons learned.
A cyber crisis in progress?
Suspected intrusion, ransomware, compromised critical account, data leak: stabilise without destroying the evidence, and get support. We open a crisis cell and keep the thread of decisions.
Prepare for the crisis before it happens.
The organisations that come through an incident best are the ones that prepared their decisions. See Galyct Pro in your context in 30 minutes, or start on your own with the free executive diagnosis.