How should continuing harm and urgency be assessed?¶
Cyber incidents can create pressure for immediate action, but urgency should be based on identifiable harm rather than the dramatic language used to describe the incident.
Avoid the dangerous assumption¶
The dangerous assumption is that every cyber alert requires the same emergency response.
Assess what is currently at risk.
Is an offender still accessing systems or accounts?
Is sensitive data being viewed, copied or published?
Are victims being contacted or impersonated?
Are essential services unavailable?
Could safety-critical, financial or operational systems be affected?
Is malicious infrastructure still active?
Could delay allow evidence to expire or further victims to be harmed?
Also assess the reliability of the information. An automated high-severity alert may need rapid investigation, but its product rating is not the same as confirmed impact.
Urgency may arise from several different causes:
- ongoing harm
- risk of escalation
- volatile evidence
- short provider retention
- business continuity
- legal or regulatory obligations
- the possibility that containment will alert the offender.
Those factors may point in different directions. Immediate shutdown may reduce harm but destroy volatile evidence. Delayed containment may preserve visibility but expose more data.
The investigator should not make technical risk decisions in isolation. Work with the affected organisation, incident responders, forensic specialists, legal advisers and relevant decision-makers.
Record the known facts, the suspected harm, the evidence supporting the assessment, the available options and the reason for the decision taken.
Urgency does not justify overstating certainty. Use language such as “ongoing access is suspected” or “the current records indicate continuing activity” where confirmation is incomplete.
Operational takeaway¶
Base urgency on continuing harm, escalation risk and evidence loss, and document how those factors shaped the containment and preservation decision.