Hour 1: Isolate the network immediately and activate your incident response plan. Hour 6: Notify leadership, insurer, and legal, and log every action. Hour 12: Verify that your backups are not ...