Cyber incident

A cyber incident at your company: the first steps, who decides and who to notify

In the first hours of an attack, such as ransomware, a few well-made moves matter most: isolate the affected systems without cleaning them up, bring the decision-makers together, keep track of the notification deadlines. Strategic supports the incident response and the recovery. Before it is needed, we prepare the plan, the roles and the exercises with you.

The first steps How to reach us during an incident

Example graphic: the first hours of a cyber incident, from isolating systems to forensic copies, up to the decision with management and the evidence log. — Example · not a real incident

Isolate, don’t clean up: the traces show what happened and support the notifications
24 hours: for the early warning to CSIRT Italia from NIS2 entities
72 hours: to notify a personal data breach, where feasible, in Italy and San Marino

01 · copy the link to this sectionThe first hours

The first steps, in order

General guidance, consistent with the guides published by the authorities. If your company has an incident response plan, the plan comes first.

Updated 7 November 2026

Isolate, don’t clean up. Disconnect the affected systems from the network. Shut them down only if you cannot isolate them, because their memory holds useful traces. Do not reinstall or delete anything.
Bring the decision-makers together. Leadership, IT, legal, the data protection officer and communications, on channels that do not run through the affected systems.
Preserve the evidence. Copies of the logs and disks of the affected systems, and of their memory when possible. A log of who does what, and when.
Keep track of the deadlines. A NIS2 entity has 24 hours for the early warning to CSIRT Italia. A personal data breach is notified within 72 hours, where feasible, to the Garante in Italy or to the Data Protection Authority in San Marino.
Ask for help early. From the provider that runs your systems, from whoever handles your security and, for crimes, from the police.

Sources (consulted on 7 November 2026)

Ransomware attack under way: what to do in the first four hours

02 · copy the link to this sectionRoles

Who decides and who communicates

In an incident, decisions belong to management. Everyone else prepares and carries them out.

CYB Management Decides on recovery, notifications and what to say externally. Approves every message to clients and staff.

CYB IT and suppliers Contain the attack, preserve the evidence and restore the systems in the order decided.

CYB Legal and data protection Track the deadlines and prepare the notifications to the authorities.

CYB Communications Clients, staff, suppliers and, if needed, the press. Short, accurate and approved messages.

CYB

The coordinator

Keeps the decision log and the deadline calendar. This can be the in-house security lead or an outsourced CISO. The outsourced CISO

CYB The analyst Works out how the attack got in and what it touched, with evidence that will still stand up later.

Cyber incident: who decides, who communicates and what to preserve in the first hours

03 · copy the link to this sectionReference

Who to notify about a cyber incident, in Italy and San Marino

Updated 7 November 2026

In short: it depends on who is affected and what was touched. Often there is more than one notification, with different deadlines.

Who	What and when	To whom	Reference
NIS2 entities in Italy	Significant incident: early warning within 24 hours, notification within 72 hours, final report within one month	CSIRT Italia, through the ACN portal	Legislative Decree 138/2024, Article 25
Public bodies under Law 90/2024	Incidents in the ACN taxonomy: report within 24 hours, full notification within 72 hours	ACN	Law No. 90 of 28 June 2024, Article 1
Any other organisation in Italy	On a voluntary basis: incidents, threats and near misses	CSIRT Italia	Legislative Decree 138/2024, Article 26
Anyone processing personal data in Italy	Personal data breach: within 72 hours, where feasible. If the risk to people is high, they must be told too	Italian Data Protection Authority (Garante)	Regulation (EU) 2016/679, Articles 33 and 34
Anyone processing personal data in San Marino	Personal data breach: within 72 hours, where feasible. If the risk to people is high, they must be told too	San Marino Data Protection Authority	Law No. 171 of 21 December 2018, Articles 34 and 35
Victims of a crime	Unauthorised access, extortion, fraud	In Italy, the Polizia Postale or a Police or Carabinieri office. In San Marino, the Gendarmeria	—

Official contacts

CSIRT Italia, the ACN incident reporting portal · Italian Data Protection Authority (Garante) · Polizia Postale (Italy’s cybercrime police) · in San Marino, the San Marino Data Protection Authority.

This box is for information only and is not legal advice. Notifications are decided with your lawyer and your data protection officer.

Sources (consulted on 7 November 2026)

04 · copy the link to this sectionIf the attack is under way

How to reach us during an incident

Through the form, choosing ‘It’s urgent’, or at staff@strategic.sm with ‘Incident in progress’ in the subject line. A request sent through the form arrives with URGENT in the subject line. In the meantime, follow the first steps above.
No passwords, IP addresses or technical details in the first message. They are exchanged later, over an agreed channel that does not run through the affected systems.
If you already have an engagement with us, use the contacts in the contract. For an outsourced CISO or an incident response plan, channels and timing are set in writing before they are needed.

Open the form

05 · copy the link to this sectionWhat we do

Before, during and after an incident

The most useful work is done before it is needed.

CYBBefore Plan, roles and exercises The incident response plan, the decision-makers’ contacts, exercises with management, isolated backups and scheduled restore tests.

CYBDuring Containment and decisions Isolate, preserve the evidence, find out how far the attack went. Decisions and notifications are prepared with your lawyer and data protection officer.

CYBAfter Analysis and recovery How the attack got in and what it touched. Orderly recovery, fixes, a final report and a review of the plan.

CYBOngoing

Outsourced CISO

A part-time head of security who holds the plan, suppliers and exercises together and coordinates when something happens. What the outsourced CISO does

06 · copy the link to this sectionFrequently asked questions

Frequently asked questions about a cyber incident

What should you do in the first hours of a ransomware attack?

Isolate the affected systems without cleaning them up, bring the decision-makers together on channels that do not run through the affected systems, preserve the evidence and keep track of the notification deadlines. Decisions on recovery and communication come later, once the picture is clear. The first steps

Should we switch the computers off?

As a rule, no. First disconnect them from the network. The CISA #StopRansomware Guide says to power them down only if you cannot disconnect them, because switching them off loses the traces held in memory.

Who should a cyber incident be reported to?

It depends on who is affected. NIS2 entities notify CSIRT Italia, with an early warning within 24 hours. Other organisations can do so voluntarily. A personal data breach is notified within 72 hours, where feasible, to the Garante in Italy or to the Data Protection Authority in San Marino. Crimes are reported to the police. Who to notify

Can you help if we are not already clients?

Yes. Write to us through the form choosing ‘It’s urgent’, or at staff@strategic.sm with ‘Incident in progress’ in the subject line. The form is not an emergency channel, so in the meantime follow the first steps on this page.

07 · copy the link to this sectionObservatory

From the Observatory: the first hours and recovery

Analysis and guides from the Strategic editorial team.

CYBCybersecurity

Ransomware attack in progress: what to do in the first four hours

Encrypted files and a ransom demand. The technical moves for the first four hours, from isolating systems to protecting the backups, from evidence to sizing up the damage, through to the most delicate choice of all, the ransom.

30 August 2026

CYBCybersecurity

Cyber incident: who decides, who speaks and what to preserve in the first hours

In the first hours of a cyber incident, management does not do the technical work. It takes three decisions that only it can take. It decides who leads the response, who speaks for the company and what must be preserved.

16 September 2026

CYBCybersecurity

Sherlock Holmes and the log files: how long to keep them, and where, to reconstruct an attack

After an incident the questions are always the same. Who got in, when, from where, and what did they touch? The log files answer them, if they still exist. Here is which logs to collect, how long to keep them and where.

28 March 2026

CYBCybersecurity

Grandad’s backup: three drawers, a sealed envelope and a restore test

Three copies, two media, one off site, one isolated and zero errors when you test them. The backup rule explained through a grandfather’s drawers, and turned into decisions for management, IT and suppliers.

19 January 2026

All cybersecurity articles

The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.

08 · copy the link to this sectionContact

Getting ready before it happens

For a plan, an exercise or an outsourced CISO, a few lines are enough. We reply by email, usually within two working days.

If an incident is in progress, choose ‘It’s urgent’ in the form and follow the first steps in the meantime. Please do not put credentials, IP addresses or technical details in the form.

Or write to us:WhatsApp staff@strategic.sm

On WhatsApp, messages are answered by Strategic’s AI assistant. Please do not use it for confidential information.