Cloud Security Incident Response Checklist

A checklist for the first hour of a suspected cloud security incident, covering containment, evidence preservation, and initial notification steps.

What’s inside

A time-boxed checklist for the first 60 minutes after a suspected incident is detected, covering isolation of affected resources, snapshotting for forensic evidence, and who needs to be notified and when.