Course Content
Cybersecurity Awareness for Corporate Teams

5.2 Steps to Contain and Report

  • The “Golden Hour”: The first 60 minutes determine the damage.

    1. Disconnect: Unplug the ethernet cable. Turn off Wi-Fi. (Do NOT shut down—this destroys RAM evidence).

    2. Document: Note the time, what you were doing, and take photos of the screen (don’t take screenshots on the infected machine).

    3. Report: Call the SOC (Security Operations Center) or IT Emergency Line immediately.