Course Content
Cybersecurity Awareness for Corporate Teams

5.2 Steps to Contain and Report

  • The “Golden Hour”:
    The first 60 minutes determine the damage.

    1. Disconnect:
      Unplug the ethernet cable. Turn off Wi-Fi. (Do NOT shut down—this destroys RAM evidence).

    2. Document:
      Note the time, what you were doing, and take photos of the screen (don’t take screenshots on the infected machine).

    3. Report:
      Call the SOC (Security Operations Center) or IT Emergency Line immediately.