---
title: First 60 Minutes Cybersecurity Incident Response Checklist
description: "Download the free First 60 Minutes checklist: containment, documentation, what to say, which notification clocks started, and follow-up training."
---

[![Atlantic Only Logo](https://pages.atlantictraining.com/hubfs/Atlantic%20Only%20Logo.png)](https://www.atlantictraining.com/)

- [HR Compliance](https://www.atlantictraining.com/catalog/human-resources-training)
- [Soft Skills](https://www.atlantictraining.com/catalog/soft-skills-training)
- [Safety Training](https://www.atlantictraining.com/catalog?limit=24&sort=produced&dir=desc&category=26)
- [EHS Software](https://www.atlantictraining.com/wave-ehs-software)
- [Course Library](https://www.atlantictraining.com/catalog)

- [HR Compliance](https://www.atlantictraining.com/catalog/human-resources-training)
- [Soft Skills](https://www.atlantictraining.com/catalog/soft-skills-training)
- [Safety Training](https://www.atlantictraining.com/catalog?limit=24&sort=produced&dir=desc&category=26)
- [EHS Software](https://www.atlantictraining.com/wave-ehs-software)
- [Course Library](https://www.atlantictraining.com/catalog)

[![CREATE YOUR PLAN](https://no-cache.hubspot.com/cta/default/5486514/98b33bbb-85ea-44d9-a7c4-8e41b65c6b25.png)](https://cta-redirect.hubspot.com/cta/redirect/5486514/98b33bbb-85ea-44d9-a7c4-8e41b65c6b25)

Cybersecurity Awareness Month 2026

# Cybersecurity Incident Response: What Your Team Does in the First Hour

 A free, printable checklist for the sixty minutes after someone realizes something went wrong. 

[Download the free First 60 Minutes Cybersecurity Incident Response Checklist](https://pages.atlantictraining.com/cybersecurity-incident-response-checklist#atl-cyber-form)

![A manager on the phone with two colleagues during the first hour of a workplace cybersecurity incident, with a checklist and laptop on the table.](https://pages.atlantictraining.com/hubfs/cyber-hero-2.jpg)

 Someone clicks something they shouldn’t have. What happens in the next sixty minutes decides how far it spreads, what evidence survives, and how defensible your response looks six months later. Most teams have never walked through that hour before they are living it.

 This free checklist gives them one. Containment steps, a documentation log, what to say and what not to say, which notification clocks just started, and what training to assign afterward. Built to be printed and kept where people can reach it, because a PDF on your network is no use during a network incident.

Sneak Peek

## What’s Inside the Checklist

Sections 1–3

### Contain, record, communicate

#### Immediate Containment

 The first fifteen minutes. Who to call, what to disconnect, and the things that destroy evidence if you do them. Includes a do-not-do list and when to bring counsel in.

#### Documentation Log

 A blank log with space for every action from discovery forward. The section people skip and the one insurers and regulators ask for first.

#### Communication Protocol

 Internal chain of command, what to tell staff, language to avoid in writing, and legal hold considerations.

Sections 4–5

### Notify, then train

#### Regulatory Notification Checklist

 Which clocks may have started. HIPAA, state laws, PCI, financial, and defense contracts, with a tracker for deadlines and owners, so you know who to call before the window closes.

#### Post-Incident Training Trigger

 What to assign, to whom, matched to the type of incident you just had.

 Plus a pre-fill contact table for your incident commander, IT lead, legal counsel, cyber insurance carrier and IR firm. Complete it today and the checklist is ready before you need it.

Free Checklist

## Get the free checklist

 Fill in the form and we will send it straight to your inbox. No cost, no catch, yours to print and share across your organization.

 Five sections covering containment through follow-up training

 Fillable log, contact table and notification tracker

 Built to print, post, and hand to whoever finds the problem

 Free, no expiry, share it across your whole organization

### Get the free checklist

 Fill in the form and we will send it straight to your inbox. No cost, no catch, yours to print and share across your organization.

 We will email you the checklist and occasional safety training resources. Unsubscribe any time.

From the Atlantic Training Blog

## Read the article

![Two colleagues reviewing an incident checklist, with a closed laptop beside them.](https://pages.atlantictraining.com/hubfs/cyber-article.jpg)

Blog · Cybersecurity Awareness

### Cybersecurity Training for Employees: 5 Costly Gaps That Waste Your First Hour

 Security budgets concentrate on keeping attackers out, while a large share of incidents begin with someone already inside clicking something they shouldn’t have. That is a training gap, not a tooling failure. The article covers the five gaps that decide what happens in the hour after an employee realizes something went wrong, including the one most training skips entirely: what to actually do next. 

[Read the full article](https://www.atlantictraining.com/blog/cybersecurity-training-for-employees/)

FAQ

## Cybersecurity Incident Response: Common Questions

### What should you do first after discovering a potential data breach?

 Notify your IT or security lead by phone or in person rather than email, which may be the compromised channel. Then isolate the affected device from the network without powering it off, since shutting down can erase evidence held in memory. Record the time of discovery before anything else, because most notification deadlines run from that moment.

### Who needs to be notified in the first hour of a cybersecurity incident?

 Your IT or security lead, your incident commander, and your cyber insurance carrier. Many policies require prompt notice and some require you to use an approved incident response vendor, so calling early protects coverage. Legal counsel should be looped in before any written statement leaves the organization.

### What should employees avoid doing after they click a phishing link?

 Avoid deleting the email, running antivirus cleanup, reimaging the machine, or logging back into the affected account to look around. Each of those destroys evidence your organization will need later. The single worst option is waiting to see whether it resolves itself, since every hour of delay is another hour of access for whoever is on the other end.

### How long do organizations have to report a data breach?

 It depends on which rules apply and where the affected people live. HIPAA requires individual notice no later than sixty days from discovery. State breach notification laws vary in both timing and triggers, and your obligation generally follows the residency of the affected individuals rather than your own location, so one incident can start several clocks at once. Confirm your specific deadlines with legal counsel.

### What training should you assign after a security incident?

 Match it to what happened. Phishing and credential incidents point toward employee cybersecurity awareness training, accidental disclosure toward data handling and privacy training, and incidents involving health or cardholder data toward the relevant compliance course. Assign it within the week rather than the quarter, while attention is still high, and record completion by name. Training nobody finished does not count as corrective action.

[![Atlantic Training Figtree Logo](https://pages.atlantictraining.com/hubfs/Atlantic%20Training%20Figtree%20Logo.png)](https://www.atlantictraining.com/)

COPYRIGHT © 2026 ATLANTIC TRAINING LLC

[About Us |](https://www.atlantictraining.com/our-story) [Blog](https://www.atlantictraining.com/blog/)

```json
{
  "@context" : "https://schema.org",
  "@type" : "FAQPage",
  "mainEntity" : [ {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Notify your IT or security lead by phone or in person rather than email, which may be the compromised channel. Then isolate the affected device from the network without powering it off, since shutting down can erase evidence held in memory. Record the time of discovery before anything else, because most notification deadlines run from that moment."
    },
    "name" : "What should you do first after discovering a potential data breach?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Your IT or security lead, your incident commander, and your cyber insurance carrier. Many policies require prompt notice and some require you to use an approved incident response vendor, so calling early protects coverage. Legal counsel should be looped in before any written statement leaves the organization."
    },
    "name" : "Who needs to be notified in the first hour of a cybersecurity incident?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Avoid deleting the email, running antivirus cleanup, reimaging the machine, or logging back into the affected account to look around. Each of those destroys evidence your organization will need later. The single worst option is waiting to see whether it resolves itself, since every hour of delay is another hour of access for whoever is on the other end."
    },
    "name" : "What should employees avoid doing after they click a phishing link?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "It depends on which rules apply and where the affected people live. HIPAA requires individual notice no later than sixty days from discovery. State breach notification laws vary in both timing and triggers, and your obligation generally follows the residency of the affected individuals rather than your own location, so one incident can start several clocks at once. Confirm your specific deadlines with legal counsel."
    },
    "name" : "How long do organizations have to report a data breach?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Match it to what happened. Phishing and credential incidents point toward employee cybersecurity awareness training, accidental disclosure toward data handling and privacy training, and incidents involving health or cardholder data toward the relevant compliance course. Assign it within the week rather than the quarter, while attention is still high, and record completion by name. Training nobody finished does not count as corrective action."
    },
    "name" : "What training should you assign after a security incident?"
  } ]
}
```