After a cyber incident:
the first hours and what follows

The first hours: do’s and don’ts#

The first decisions determine whether you will still be able to find out what happened. CISA and NCSC guidance says the same: isolate in a coordinated way, preserve evidence, communicate on a channel the attacker cannot see ²⁵.

• Isolate affected systems; if there are many, take the network offline at the switch. In the cloud, take a volume snapshot ².
• Power devices off only if you cannot disconnect them: shutting down destroys evidence in volatile memory ².
• Take system images and memory captures on a sample of devices, starting with volatile evidence ².
• Keep a central decision log — what, when, who, why — with standardised time ⁵.
• Investigate, as far as possible, before restoring ⁵.

The conflict between preserving evidence, containment and continuity is real; ENISA asks for it to be decided through a clear, pre-agreed process with chain-of-custody rules ⁸. The ASC methodological guide adopts the same requirement for Moldova ²⁵.

Whom to notify, and how fast#

In the Republic of Moldova, the competent authority is the Cybersecurity Agency (ASC), which is also the national incident response team ¹³¹⁴. A provider identified under Law 48/2023 notifies it within 24 hours of becoming aware — even when significant impact can only be reasonably assumed — follows up with an update within 72 hours and a final report within a month ¹³. Notification is made through the “Report an incident” form on ncsc.md ¹⁶; the official template provided for by Decision 562/2025 is approved by the ASC director ¹⁵.

The new personal data law, Law 195/2024, has been in force since 23 August 2026 and adopts the GDPR rules: notification within 72 hours “where feasible”, with the reasons if late, informing people at high risk, and documenting every breach ¹⁷²². A Moldovan company with EU customers and a representative there has no “one-stop shop”: it notifies every authority in the states where affected people live ²³.

Ransomware: to pay or not#

The official position is the same on both sides of the Atlantic. CISA and the FBI “do not encourage paying”: it does not guarantee recovery and encourages further attacks; report anyway, whether you pay or not ¹². NCSC UK stresses that law enforcement does not encourage, endorse or condone payment, and ENISA advises not to pay and not to negotiate ⁷⁹. Even after paying, decryption can take weeks and does not fix the vulnerabilities the attacker came through ⁶.

The EDPB guidelines treat ransomware separately: if there is a backup and no data was exfiltrated, notification may not be required, but the breach is documented; and risk assessment does not wait for the forensic report ²⁴.

Containment, eradication, recovery#

In 2025 NIST rewrote its incident response guide (SP 800-61 Rev. 3) as a CSF 2.0 profile: the old phases map onto the framework’s functions, and lessons learned are shared immediately, not only at the end ¹.

• Establish the root cause and look for indicators of compromise and persistence on unconfirmed targets too — otherwise you underestimate the scope ¹.
• Check backup integrity before restoring — NCSC advises assuming they may be compromised too ¹⁶.
• Before production, check restored assets for indicators of compromise and fix the root cause ¹.
• Look for the “precursor” malware (the dropper) before rebuilding ².
• Declare the incident over against criteria and write an after-action report ¹.

After the incident: proof the breach is closed#

Systems working again does not mean the attacker has left. After eradication, CISA calls for monitoring for re-entry, an independent test or review to validate the return to normal, testing controls before production, and emulating the attacker’s tactics to verify countermeasures ⁴. Advisory AA20-245A recommends having eradication confirmed by a third party ³, and NCSC notes partners may ask for independent assurance before reconnecting to your systems ⁶.

The lessons-learned meeting is held with owners and deadlines; findings feed into the risk assessment, and logs are kept for at least 12 months ¹⁸¹⁵.

How we help after an incident#

1. Compromise assessment

   We look for the attacker’s traces and persistence mechanisms on restored and unconfirmed systems.

2. Retesting the entry vector

   We verify the vulnerability the attacker came through is closed and that there is no alternative route.

3. Attack emulation

   We replay the attacker’s tactics so you can see whether the new detection and countermeasures work.

4. A report for the authority and partners

   Findings, evidence and the conclusion of the independent test, ready to attach to the final report.

Frequently asked questions