Reporting & Incident Hygiene — The First 30 Minutes Matter Most

A receptionist at a 200-person Dutch SaaS company sees an unfamiliar program window pop up on a colleague's monitor while passing by: 'Your files have been encrypted. Pay 1.5 BTC within 48 hours.' The colleague is at lunch. The receptionist's first instinct is to turn off the laptop to 'stop the spread'. Her second instinct is to call IT. She calls IT first. They tell her: do NOT power off, do NOT close the program, do NOT unplug from the network. Take a phone photo of the screen. Leave the device exactly as it is. They arrive within 12 minutes, disconnect the device from the network (not the same as powering off), capture forensic state from the live system, and find that the ransomware had not yet reached the file server because the network was segmented. The damage is contained to one laptop. If she had powered off, the encryption-key state in RAM would have been lost and the forensic team couldn't have determined the strain or the time of compromise. Her two-minute pause to call first saved the response.

When something feels wrong, the first decision is whether to report. Default: report. Reporting is free, fast, and tells security something they need to know — even if it turns out to be nothing. The four moves to make immediately: **(1) Stop interacting** with the suspicious thing — don't click further, don't type more, don't open more files. **(2) Capture context** — take a phone photo of the screen, note the time, note what you were doing when it started. **(3) Report** through your fastest channel — security email, Slack #security, the IT helpdesk, the 'Report Phishing' button in your mail client. **(4) Wait for instructions** — IR teams have playbooks for each scenario. The four moves NOT to make: **(1) Don't power off** the device — RAM holds forensic state. **(2) Don't run a virus scan** before security says so — it can wipe evidence. **(3) Don't delete the suspicious email/message/file** — it's evidence; move to a quarantine folder if you must. **(4) Don't tell external parties yet** — incident communication is coordinated by leadership and legal under NIS2 and GDPR. Reporting clocks: under NIS2 (in force for most NL/EU enterprises in 2026), early-warning notification to NCSC must happen within 24 hours of awareness; full incident report within 72 hours. Under GDPR, breaches involving personal data must be reported to the Autoriteit Persoonsgegevens within 72 hours, with affected individuals informed if 'likely high risk'. Non-technical staff don't run the reporting clock themselves — security and legal do — but a fast report from staff is what starts that clock correctly.

• Unexpected pop-ups demanding payment or claiming to be antivirus / law enforcement / Microsoft
• Files in your folders that you didn't create, or files suddenly inaccessible / encrypted
• Browser opening unfamiliar tabs, redirects to unfamiliar sites
• Unfamiliar mailbox rules, unfamiliar OAuth apps, sign-ins from unfamiliar countries
• Devices behaving unusually — slow performance, fan running constantly, unfamiliar processes in Task Manager / Activity Monitor
• Colleagues reporting they 'got an email from you' that you didn't send

1. Stop interacting with the suspicious thing immediatelyDon't click further, don't type more, don't enter credentials, don't open more files.
2. Take a phone photo of the screen and note the timePhoto + time is the simplest forensic capture any non-technical employee can do.
3. Report through your fastest channelMail client's Report-Phishing button, security email distribution list, Slack #security, IT helpdesk phone. Faster channel beats fancier channel.
4. DO NOT power off the device or run a virus scan until security says soBoth destroy forensic state. The damage you fear from 'leaving it running' is far less than the damage from losing evidence.
5. Wait for instructions — don't escalate externally yetIncident communication is coordinated. Premature external statements can break legal reporting strategy.
6. Preserve the message / file / email — don't deleteMove to a 'Quarantine' folder if you must. Security needs the artefact.

• NCSC-NL — Wat te doen bij een incident[primary]
• Autoriteit Persoonsgegevens — Datalekken melden[primary]
• ENISA — NIS2 reporting guidance[primary]
• NIST SP 800-61 — Incident Handling Guide[primary]

• How Attackers Think — The Mindset Behind Every Modern Cyber Attack

  6 min read

• The Five Attack Categories — A Map of What You'll Actually Face

  7 min read