When a cyber incident occurs, the response during the first 24 hours can significantly affect an organization’s ability to contain the damage, restore operations, preserve insurance coverage, and meet legal and regulatory obligations. Although every incident is different, a prompt, coordinated, and disciplined response is essential. The following are key actions to take during the first 24 hours of an incident.
| For MEARIE Members, the first and most important step is to report any suspected or confirmed cyber incident to MEARIE as soon as they become aware that something may have occurred. |
Members should not wait until every fact is known or the full scope of the incident has been confirmed. Unauthorized access, ransomware, phishing, suspicious network activity, or any other potential cyber event should be reported promptly. Early notification allows MEARIE and its claims partners to coordinate the appropriate response resources, help protect coverage, reduce delays, and provide access to specialized cyber experts when they are needed most.
Once the incident has been reported, the affected environment should be preserved as carefully as possible. Organizations should avoid deleting files, reimaging systems, or making other changes unless directed by forensic experts. System logs, screenshots, emails, alerts, and other digital records may be essential to determining how the incident occurred. This information can also help to determine which systems were affected, and whether sensitive information was compromised.
A clear timeline of events and actions taken can also support forensic investigators, insurers, legal counsel, and regulators. The need for reliable evidence is reinforced by findings that the average breach lifecycle—the time required to identify and contain a breach—was 241 days in 2025. [i]
At the same time, the organization should activate its cyber incident escalation procedure. The procedure should identify who must be notified, when notification is required, and who has the authority to make key decisions. Depending on the circumstances, the response team may include IT, senior leadership, legal counsel, communications personnel, and risk management representatives. Clearly defined roles help the organization respond quickly and consistently as the situation evolves.
Communications should be managed with the same care as the technical response. In the early stages of an incident, information is often incomplete and can change quickly. Internal and external messaging should therefore be coordinated through designated personnel to maintain accuracy and consistency. Organizations should avoid speculating about the cause, scope, or impact until the facts are known. This measured approach helps maintain stakeholder confidence and limit the spread of misinformation. It is particularly important that the human element participated in 60% of the breaches examined in a 2025 study, including incidents involving errors, social engineering, and misuse.[ii]
An effective first-day response depends on preparation completed well before an incident occurs. Organizations should regularly review their incident response plans, maintain current contact lists, confirm reporting requirements, and conduct tabletop exercises. These steps help teams understand their responsibilities, make decisions more confidently, and reduce confusion during a cyber event.
This protocol outlines reporting expectations, notification procedures, key contacts, vendor approval requirements, and available response resources. Members are encouraged to review the protocol, incorporate it into their incident response plans, and ensure that the appropriate personnel know how to access it.
[i] IBM Security. (2025). Cost of a data breach report 2025. IBM Corporation. https://www-api.ibm.com/adobe/assets/urn:aaid:aem:607b9590-38e0-4c91-b433-aa8a17f5b5e8/original/as/cost-of-a-data-breach-2025-full-report.pdf
[ii] Verizon. (2025). 2025 data breach investigations report (DBIR). Verizon Business. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
At The MEARIE Group, we remain committed to providing the most up-to-date insights on risk management and industry best practices. Should you have any questions or require further information, please do not hesitate to reach out.