When a government agency suspects a cybersecurity incident, activate its approved incident-response plan, organize the response, assess and contain the threat, and report through the required channels. For U.S. Federal Civilian Executive Branch (FCEB) agencies, CISA’s playbook sets out a coordinated process for incidents involving confirmed malicious activity when a major incident has been declared or cannot yet reasonably be ruled out.
First, confirm which rules apply
CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks are designed for FCEB agencies. CISA says the practices may also help other organizations, but the federal reporting deadlines and procedures should not be assumed to apply to state, local, tribal, territorial, foreign, or private organizations.
As an Amazon Associate I earn from qualifying purchases.
CISA directives apply to federal civilian agencies but exclude statutorily defined national security systems and certain systems operated by the Department of Defense or Intelligence Community. Agency counsel and security leadership should confirm which requirements govern the affected system and incident; see CISA’s directives.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Who should be on the agency response team?
Use the agency’s approved incident-response plan to establish leadership and bring in the people who can make security, operational, legal, and mission decisions. CISA’s playbook identifies the agency CIO, CISO, and affected mission or system owners as participants in major-incident analysis; when a breach is involved, it also identifies the Senior Agency Official for Privacy.
Depending on the incident and agency plan, involve privacy, legal, communications, continuity, law-enforcement, and contract contacts. Assign primary points of contact and identify surge support in case the incident exceeds available staff, as recommended in CISA joint guidance.
- Name an incident lead and establish a secure channel for response coordination.
- Maintain an event log and decision record, including times, affected systems, known indicators, approvals, and actions taken.
- Restrict access to incident records and coordinate evidence handling with agency investigators and counsel.
What should the response team do first?
1. Triage the incident and preserve evidence
Establish what was observed, when activity began, which systems or data may be affected, whether malicious activity is continuing, and which mission services are at risk. Preserve relevant logs, endpoint and network telemetry, identity records, communications, and volatile evidence when feasible. Record timestamps and evidence provenance. Avoid destructive cleanup until the response team has captured what it needs to assess scope and persistence.
2. Contain the threat without losing sight of mission impact
Choose containment measures based on the threat, affected system, evidence needs, and service availability. Depending on the circumstances, options may include isolating a host or network segment, disabling compromised credentials, blocking indicators, restricting remote access, or moving a service to a known-good environment.
Recommended Free Tools
Rank #2
Before acting, document who approved the measure, its expected effect, and its operational risks. No single action is right for every incident: stopping spread may interrupt a critical government service or remove evidence needed to understand the intrusion.
3. Notify and coordinate with CISA
For FCEB processes, the CISA playbook gives these initial-report deadlines:
Rank #3
| Trigger | Initial report deadline |
|---|---|
| Incident determination | Within one hour after determination, under the Federal Incident Notification Guidelines cited in CISA’s playbook. |
| Declaration of a major incident | Within one hour after declaration, under OMB M-20-04 as cited in CISA’s playbook—even if the agency’s internal review chain has not finished. |
Use the agency’s maintained reporting route and current CISA instructions; do not rely on an old contact list or assume every agency uses the same operational channel. CISA’s official reporting guidance lists an online report page, 1-844-Say-CISA (1-844-729-2472), and [email protected]. Confirm that these details and the agency’s routing remain current before using them during an incident.
4. Make reports and updates useful
State what is known and uncertain, the affected systems and mission functions, the timeline, current impact, response actions, and remaining work. Include relevant indicators and estimates for containment, eradication, and recovery. Update CISA when material facts change, share relevant atomic and behavioral indicators and countermeasures, and provide post-incident updates as directed. The playbook calls for updates until eradication is complete.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow should the agency eradicate the threat and recover?
Recovery should follow the agency plan and be coordinated with system and mission owners. The right actions depend on how the attacker gained access, what persistence remains, and which services must be restored first.
- Remove malicious artifacts and address exploited weaknesses; rotate affected credentials and secrets as appropriate.
- Restore from trusted sources and return systems to service in a controlled way.
- Validate that services, security controls, and monitoring are working, then watch for renewed activity.
- Record lessons about response delays, missing information, and changes needed to policy, logging, staffing, or vendor arrangements.
CISA’s FY 2025 Inspector General FISMA Reporting Metrics assess whether agencies have incident-handling processes for containment, eradication, recovery, and protection of incident data and metadata.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
