The first 24 hours protect the final explanation.

Hour 0 to 1: protect people and stop evidence loss

Life safety, environmental protection, and essential operational containment come first. Evidence preservation does not justify leaving a dangerous condition active. Record the pre-change state when safely possible, then make the minimum authorized change required to control immediate harm.

1. Name one response owner. Establish who coordinates decisions, records, specialists, and status updates. This does not determine fault.
2. State the observed outcome. Describe what is happening in neutral, measurable language. Do not embed an untested cause.
3. Preserve volatile sources. Capture relevant logs, alerts, configuration, system time, field state, and current issued records within lawful authority.
4. Record containment changes. Who changed what, why, when, with whose approval, and what evidence was preserved first?
5. Separate workspaces. Preserve originals; perform analysis and repair on controlled copies or documented environments.

Hours 1 to 4: establish control

Create a single event register. Every material action should have a timestamp, actor, purpose, authorization, affected system or record, and result. This prevents parallel responders from overwriting each other’s work or creating contradictory histories.

Set four gates

• Change gate: only named roles can authorize consequential repair or configuration changes.
• Evidence gate: one custodian controls originals, collections, hashes where appropriate, exports, and access logs.
• Communication gate: one source issues internal and external status language.
• Scope gate: adjacent issues are logged but do not silently expand the response.

Identify the systems, locations, records, organizations, and time range in scope. State what is excluded and why. Scope can change, but every change should be explicit so later reviewers understand what the team did and did not examine.

Hours 4 to 12: build the first chronology

Collect the minimum records needed to understand the current consequence and immediate causal candidates. Avoid an indiscriminate data sweep. Prioritize sources by volatility, relevance, authenticity, and the time required to preserve them.

Interview notes should separate direct observation from what the person heard from others and from their interpretation. Ask witnesses not to compare or harmonize recollections before their individual accounts are captured.

Identify at least two credible explanations. For each, list predicted evidence and contradicting evidence. This protects the response from locking onto the first plausible story.

Hours 12 to 24: define the controlled next phase

By the end of the first day, the organization may not know the cause. It should know who owns the response, what has been preserved, which immediate controls are active, which facts are established, and which decisions are due next.

First-day handover

• current operational and safety state;
• observed impact and affected boundaries;
• response authority and named owners;
• preserved evidence register and known gaps;
• chronology through the handover time;
• changes made and their validation status;
• leading explanations and confidence limits;
• notifications made or required;
• next decision points, hold points, and escalation triggers.

Decide whether the next phase requires specialist engineering, digital forensics, legal, safety, privacy, insurance, communications, regulatory, or contractual support. The first-day team should not exceed its competence merely to keep the process internal.

Use a bounded situation statement

A disciplined early statement is short enough to update and precise enough to resist rumour:

At [time], we observed [neutral outcome] affecting [defined boundary]. Immediate controls are [actions]. We have confirmed [facts]. The cause and responsibility remain under review. Evidence preservation covers [sources]. The next update will follow [decision or time].

Keep internal fact-finding separate from external communication. Do not publish names, allegations, private records, technical exploit detail, or causal claims simply because they appear in working notes. Where mandatory reporting applies, use the required channel and obtain appropriate advice.

What creates avoidable exposure

• editing or deleting original records;
• using a public chat or informal group as the only incident log;
• allowing multiple uncoordinated repair writers;
• describing a hypothesis as confirmed cause;
• assigning blame before mapping scope and decision authority;
• circulating sensitive evidence to broad distribution lists;
• contacting family, unrelated employers, customers, or media to create pressure;
• collecting data outside the authorized scope;
• promising recovery, safety, or legal outcomes that have not been verified.

The first day succeeds when later reviewers can see that the organization protected people, limited further harm, preserved the record, and maintained the distinction between fact and theory.