At 09:13, a finance director discovers that a supplier’s bank details have been changed and a substantial payment has left the business. The instinct is to reset passwords, switch off systems and ask IT to investigate. Those actions may be necessary, but an uncontrolled response can destroy the very evidence needed to trace the attacker, recover funds, satisfy regulators or support later proceedings. This guide to cyber incident reporting explains how to act quickly without compromising the evidential record.
For solicitors, internal legal teams and business leaders, reporting is not simply an administrative task. It creates the first contemporaneous account of what was known, when it was known and what was done. A clear report supports proportionate containment. A poorly handled one can create avoidable gaps, inconsistent accounts and questions about the reliability of digital evidence.
What counts as a reportable cyber incident?
A cyber incident is any event that threatens the confidentiality, integrity or availability of systems, data or digital services. It may involve an external attacker, but it can also arise from an employee, contractor, former partner or third party with legitimate access.
Common examples include business email compromise, ransomware, unauthorised access to cloud accounts, suspected monitoring of a device, theft of intellectual property, fraudulent payments, deletion of business records and disclosure of personal data. A suspicion may be enough to justify escalation. Waiting for certainty is often the reason evidence is overwritten or reporting deadlines are missed.
Not every event must be reported to the same body. The appropriate route depends on the nature of the incident, the data affected, the organisation’s sector, contractual obligations and whether criminal conduct is suspected. The immediate internal report should therefore be treated separately from any notification to a regulator, insurer, customer, law enforcement body or affected individual.
The first hours: contain the threat, preserve the facts
The first priority is to reduce ongoing harm. The second is to preserve what happened before ordinary business activity alters it. These aims can conflict. Disconnecting a compromised laptop may stop remote access, for example, but switching it off can remove volatile information held in memory. The right decision depends on the threat, the device and the likely value of the evidence.
Create a single incident record immediately. Record the time the issue was identified, the person who identified it, the systems and accounts involved, observed indicators, actions taken and the people authorised to take them. Use a contemporaneous log rather than reconstructing events later from memory.
Where possible, preserve the following before systems are cleaned, rebuilt or returned to normal use:
- screenshots showing suspicious emails, messages, alerts, account activity or file changes;
- original emails in their native form, including headers and attachments;
- relevant audit logs from endpoints, servers, firewalls, cloud platforms and identity services;
- affected devices, removable media and mobile phones in the condition in which they were found;
- records of access, including badge logs, VPN records and administrator activity; and
- payment instructions, invoices, bank correspondence and transaction references where fraud is suspected.
Do not forward suspicious emails between staff if the original can be retained instead. Do not ask multiple people to inspect a device informally. Do not run unrecorded anti-virus scans, delete accounts or reinstall operating systems before considering whether the activity may become evidence. These actions may be operationally sensible in some circumstances, but they should be documented and authorised.
A guide to cyber incident reporting: the essential record
An effective incident report distinguishes fact from assumption. It should say what has been observed, what is currently unknown and what steps are being taken to establish the position. Statements such as “the system was hacked” are rarely helpful at the outset. A more defensible formulation is: “At 09:13, an unauthorised login from an unrecognised location was identified in the finance mailbox. The scope and method of access remain under investigation.”
The report should identify the affected organisation, reporting individual and incident lead; provide a time-stamped chronology; describe the affected systems, accounts and data; record immediate containment measures; and state the current business, legal and personal-data impact. It should also identify preservation actions, including where devices or copies of data are held and who has access to them.
For a legal or disciplinary matter, maintain a separate evidence schedule. Each item should have a unique reference, a description, the date and time it was obtained, the person who obtained it, its source and every subsequent transfer or examination. This is the chain of custody. It demonstrates that the material examined is the material originally obtained and that it has not been altered without explanation.
A formal forensic acquisition may be necessary where evidence is likely to be disputed. A specialist can create verified forensic copies, calculate integrity values, document the method used and conduct analysis without changing the original source. This is materially different from copying files to a USB drive or taking screenshots alone.
Know your external reporting duties
For UK organisations, a personal data breach may need to be reported to the Information Commissioner’s Office where it is likely to result in a risk to individuals’ rights and freedoms. The assessment and, where required, report should normally be made without undue delay and within 72 hours of becoming aware of the breach. If there is likely to be a high risk to individuals, direct communication with affected people may also be required unless an exception applies.
The 72-hour period is not a reason to speculate. Initial notifications can be made with the information available, followed by further detail as the investigation progresses. What matters is that the decision-making process is recorded: when the organisation became aware, what was known at each point, who made the risk assessment and why a report was or was not made.
Sector-specific rules can impose further obligations. Financial services firms, operators of essential services, digital service providers, public bodies and organisations bound by contractual incident clauses may face different notification requirements. Cyber insurance policies can also require prompt notice and may specify approved incident-response providers. Review those obligations early, before engaging third parties or making admissions.
Where criminal activity is suspected, preserve material suitable for a police report and take early advice on the appropriate reporting route. In payment fraud cases, speed is critical: contact the bank through its established fraud channel at once, while separately retaining all communications and transaction records. Recovery efforts and evidential preservation should proceed together, not as competing priorities.
Avoid contaminating evidence during the response
The pressure to restore operations can lead to well-meaning mistakes. Staff may change settings, access shared mailboxes, copy documents, communicate with the suspected individual or alert a third party who then destroys evidence. A coordinated response limits that risk.
Appoint one incident lead with authority to maintain the log and approve significant actions. Instruct staff not to discuss the incident externally or on informal messaging channels. Preserve relevant accounts and devices, but ensure any restriction is lawful and proportionate, particularly where personal devices or employee communications are involved.
Independence also matters. Internal IT teams are often best placed to contain an incident, but they may not be equipped to conduct a defensible examination of their own systems or decisions. Where litigation, regulatory scrutiny, employee misconduct or criminal allegations are foreseeable, an independent forensic examination can provide a transparent account of the available evidence and the limits of the findings.
Turn the incident record into a defensible investigation
An incident report is the starting point, not the finished investigation. Once immediate risk is controlled, define the questions that need answering. Was access unauthorised? Which accounts, systems and data were affected? What was accessed, copied, deleted or transmitted? Can activity be attributed to a person or device? Did the organisation’s response alter relevant material?
The scope should be proportionate. A suspected phishing email may require examination of mailbox rules, login history and linked cloud activity. An allegation of data theft by a departing employee may require preservation of the employee’s laptop, phone, cloud storage, USB activity, email and access logs. Broad collection without a defined purpose can be costly and may create unnecessary privacy and disclosure issues.
Computer Forensics Lab approaches these matters through documented preservation, forensic examination and clear reporting designed to withstand scrutiny. The objective is not merely to identify technical indicators, but to present reliable findings that solicitors, decision-makers and courts can understand.
Keep the original incident log intact, even if later findings show that early assumptions were wrong. A candid record of uncertainty and proportionate action is usually far more credible than a polished account written after the fact. When the next urgent call comes, that discipline may be the difference between a contained incident and an evidential dead end.