How to create a cyber incident response procedure

When a suspicious message appears or a device starts behaving strangely, uncertainty is often the first problem. Employees may wonder whether they should keep working, contact IT or simply wait. A clear cyber incident response procedure for employees removes that uncertainty by providing instructions before an emergency occurs.

The procedure should also remain simple. Cybermalveillance.gouv.fr reported a 112% increase in requests related to computer hacking among professionals in 2025. A twenty-page document is unlikely to help in a stressful situation. A short, readable and easily accessible guide will usually be far more useful.

Not every employee has the same understanding of the word “incident”. Start with concrete examples: a phishing email, a locked account, an unexpected MFA request, a suspicious file or an unknown login. A computer displaying an unusual warning or suddenly inaccessible files should also raise concerns.

Your cyber incident response checklist does not need to cover every possible scenario. A simple rule can already make a difference: if something looks unusual, report it quickly. This prevents employees from waiting for absolute proof before asking for help.

Employees should never spend several minutes looking for the right person to call. The procedure should clearly display a phone number, email address or dedicated reporting channel. Depending on the organization, this could be the IT helpdesk, IT department, CISO or an external provider.

You should also plan a backup option. If email or Teams becomes unavailable, a phone number can keep the reporting process working. This contact information should be highly visible in your cyber incident action plan, because an effective response begins with a fast alert.

Employees are not expected to resolve the incident themselves. Their main role is to avoid making it worse. Depending on the situation, the first instruction may be to disconnect the device from the network without necessarily shutting it down, then stop using it until IT provides further instructions.

These actions can help limit potential spread while preserving useful information for investigation. However, the exact instructions should match your technical environment. A cybersecurity incident procedure for employees should therefore be developed with the people responsible for your organization’s security.

A good procedure should also cover the mistakes to avoid. Immediately deleting a suspicious email, repeatedly restarting a computer or downloading a random security tool from the internet can make an investigation more difficult.

Employees should especially avoid hiding a mistake because they are afraid of being blamed. Anyone can click on a convincing malicious link. The sooner the incident is reported, the more time security teams have to respond. A cyber incident reporting procedure should therefore encourage transparency rather than blame.

A cyberattack may affect the communication tools employees normally use. In that situation, everyone should know where to find reliable information. The procedure can include an alternative communication channel, an emergency contact list or a dedicated phone number.

This also prevents each department from communicating independently. During a stressful incident, conflicting messages can create even more confusion. Centralized communication helps everyone receive the same instructions and understand what they should do next.

A good checklist should be understandable within seconds. A simple sequence works well: detect → isolate → report → stop intervening → share useful information. This gives employees an easy framework to remember, even when they are under pressure.

Employees can then provide useful context, such as the time of the incident, the message displayed, the action performed just before it happened or the name of the affected file. This cyber incident checklist for employees can be added to the intranet, displayed near workstations or shared after training. Most importantly, it should always be easy to find.

Not every cyber incident automatically becomes a personal data breach. However, data loss, unauthorized access, alteration or disclosure may fall into this category. The organization must then assess the potential consequences for the people concerned.

The CNIL states that a breach presenting a risk should be reported without undue delay and, where feasible, within 72 hours. It must also be documented internally. Employees are not expected to manage this process themselves. Their responsibility is much simpler: report the incident quickly to the appropriate people.

A written procedure is not always enough. In a stressful situation, people tend to rely on habits they have already practiced. Training scenarios can therefore simulate phishing, a compromised account or a suspicious device, then ask employees to choose the right response.

This makes cyber incident awareness training for employees much more practical. Training can help employees understand why secure configurations, access controls and everyday digital habits matter before an incident occurs.

Creating an effective cyber incident procedure does not require a complicated document. It mainly needs to answer four questions clearly: what should employees recognize, who should they contact, what should they do and what should they avoid? The procedure must then remain easy to access and simple enough to use without hesitation.

Training helps turn these instructions into real habits. A strong cyber incident response procedure does not replace technical teams. It simply enables every employee to contribute to a faster, more organized response when an incident occurs.