The first 24 Hours: Checklists, choices and chaos in cyber crisis response

In a major cyber incident, the first 24 hours are characterised by incomplete information, conflicting priorities and intense time pressure. In that environment, well-designed checklists can make the difference between calm, coordinated action and costly chaos. Yet many organisations either don’t have fit-for-purpose checklists or discover that their glossy playbooks are unusable when it really matters.

This session presents a practical, vendor-agnostic approach to using checklists to guide Incident Response / Crisis Coordination and Recovery decisions in the critical first day of a significant cyber event. We will cover three time horizons – the first 2 hours, first 8 hours and first 24 hours – and show how simple, targeted checklists can support technical teams, executives, legal, and communications.

At the same time, we recognise that the "perfect" checklist will not always exist on day zero. The session introduces techniques for creating and refining checklists during and after an incident, as part of an agile response and learning process – without slowing down critical work. Attendees will see examples of good and bad checklists, walk through a short incident vignette using a live checklist, and leave with templates they can adapt to their own organisations and maturity levels.