Compromised critical account
Administrator, management, finance, email, cloud, VPN, business application or provider account with privileges.
Module · Incident management
Run an incident with a timestamped decision log
The module brings together the situation, roles, actions, deadlines and decisions taken during the incident. Relevant technical material and communications can be attached to the timeline and exported at the end of the crisis.
Timestamped log · evidence preserved · 72-hour notification framed.
01 · WARNING SIGNS
When the situation must be handled as a crisis
A cyber crisis does not always start with visible ransomware. It can begin with a weak signal, a business inconsistency or an alert from a provider.
Fraud or suspicious transfer
Fake bank details, change of bank details, supplier impersonation, urgent order or approval under pressure.
Data leak or exposure
Customer documents, HR data, health data, contracts, personal data, trade secrets or files placed beyond your control.
Abnormal activity on the information system
EDR alerts, unusual logins, unknown scripts, accounts created, mail rules, abnormal network volume.
Business outage
Critical tool blocked, production stopped, invoicing unavailable, customer portal affected or essential provider failing.
External pressure
Ransom demand, threat of disclosure, media enquiry, worried customer, demanding insurer, authority or main contractor.
02 · THE FIRST 72 HOURS
An operational timeline that management can read
The initial scoping produces a shared view: preserve what will make it possible to understand, qualify the scope, contain without blinding yourself, decide on continuity, then stabilise. An indicative guide, to be adapted to the nature of the incident and to the applicable obligations.
0 to 2 hPreserve & qualifyPreserve the evidence, write down facts and times, identify the scope affected, avoid irreversible actions, alert the key decision-makers.
2 to 12 hContain & secureIsolate the systems concerned, secure sensitive access, check privileged accounts, confirm business impacts, organise the cell.
12 to 24 hDecide & steerPrioritise actions, decide on continuity measures, frame communication, document decisions, prepare remediation.
24 to 72 hStabiliseConsolidate remediation, check backups, track stabilisation indicators, prepare the lessons learned, plan the reinforcement.
03 · DOCTRINE
At the start of an incident, preserve the ability to understand tomorrow.
The priority is neither to understand everything immediately nor to erase everything. It is to stabilise, preserve, decide and document, without having destroyed the evidence or lost control of decisions.
A reading that management, IT, legal, the business units and the partners concerned can understand. We always distinguish the finding, the hypothesis and the decision.
04 · CRISIS CELL
Linking the technical, the legal, the business and reputation
We structure coordination so that no one makes an isolated decision on partial information.
ManagementTrade-offs, continuity, budgets, strategic exposure.
IT / securityTechnical scope, access, logs, containment.
DPO / legalPersonal data, notification, evidence, contracts.
Business unitsCritical processes, customers, production, priorities on the ground.
CommunicationInternal messages, customers, partners, public stance.
Insurance / providersClaims, scope of intervention, traceability.
05 · EVIDENCE
Preserve what will make it possible to explain, decide and justify
Evidence is not only technical. It includes the decisions taken, the requests received, communications, business impacts and material sent by third parties.
Technical traces
Logs, alerts, EDR captures, logins, accounts, rules, suspicious files.
Business traces
Invoices, bank details, exchanges with suppliers, tickets, transactions, outages.
Decision traces
Times, approvals, trade-offs, protective measures, communications sent.
External traces
Customer emails, messages from providers, insurer, bank, platform, authority or complaint.
06 · TRADE-OFFS
The questions that shape the decision
Effective crisis management turns uncertainty into documented decisions, even when the technical analysis is not yet complete. Every trade-off goes into the decision log.
Should we isolate?
Which systems should be cut off, kept running, monitored or switched over without making the business outage worse?
Should we notify?
Which data is concerned, with what level of certainty, and who must qualify the obligation?
Should we communicate?
Who informs employees, customers, partners, insurers or main contractors, and in how much detail?
Should we rebuild?
Which path to recovery, which security prerequisites, which business priority?
Should we file a complaint?
Which factual and chronological material can be kept to support the complaint?
Should we activate the BCP/DRP?
Which processes are priorities, which degraded solution, which recovery threshold is acceptable?
07 · DEADLINES & NOTIFICATION
Deadlines met, a framed 72-hour notification
The playbooks carry response SLAs and a regulatory countdown. The module reminds you of deadlines; it does not replace legal qualification.
Response SLAs
Each playbook sets timestamped milestones: acknowledgement, scoping, cell opened, protective measures. You know where you stand.
72-hour notification
Personal data breach: the CNIL countdown is tracked, the material to gather is pre-structured. The decision to notify is still qualified with your competent contacts.
Timestamped log
Facts, actions and decisions are dated and recorded as they happen: a timestamped thread that can be exported for the insurer, the regulator or the lessons-learned review.
08 · DELIVERABLES
A crisis outcome a committee can work with
The aim is not only to “fix” things. You must explain what happened, what was decided, what remains uncertain and what needs to be strengthened.
Management summary
Facts, impact, decisions, residual risks, next steps.
Incident timeline
Initial signal, actions, evidence, communications, decisions.
Evidence register
Material collected, source, date, purpose, limits.
Remediation plan
Short-term priorities, structural measures, owners, deadlines.
Committee / insurance material
A clear reading for decision-making, follow-up or controlled transmission.
Lessons learned
Probable causes, gaps, strengths, resilience trajectory.
09 · WHAT WE DO NOT PROMISE
Serious crisis management knows how to say no
Credibility rests on careful qualification, traceable facts and a clear distinction between finding, hypothesis and decision. No result is guaranteed.
No hasty attribution
Identifying a perpetrator or a group requires solid evidence. A hypothesis must not become a certainty.
No guaranteed recovery
Recovery depends on backups, the scope affected, the access that can still be trusted and the actual state of the information system.
No automated legal decision
Notification, filing a complaint, external communication or activating insurance must be qualified with the competent contacts.
A cyber crisis in progress?
Suspected intrusion, ransomware, compromised critical account, data leak: stabilise without destroying the evidence and set out the facts before any irreversible action. We open a crisis cell and keep the thread of decisions.
See incident management in your context.
A 30-minute live demo: timestamped playbooks, crisis cell, decision log and 72-hour notification, applied to your organisation. No commitment.