The first thing most people do in an incident is the thing that destroys the evidence.
Someone finds a suspicious machine and reboots it. Or reimages it. Or pulls the network cable and then, an hour later, cannot answer the only question that matters: was anything taken, and from where else. Memory is gone, the running process list is gone, and the established connections that would have named the second compromised host are gone with them.
So the useful skill is not speed. It is knowing which actions are reversible and which are not, and taking the irreversible ones deliberately rather than by reflex.
Reversible: isolating a host at the switch or firewall, disabling an account, blocking an address, revoking a session. All of these stop the bleeding and can be undone in a minute if you were wrong.
Not reversible: rebooting, reimaging, deleting files, running a cleaner. These destroy state that existed only in memory or only in that filesystem, and they cannot be recovered by wanting them back.
That gives you the ordering for the first hour. Contain reversibly. Capture volatile state — memory first, because it disappears when the power does, then the process list, network connections, and logged-in users. Only then decide about the disk.
There is a real tension here and it is worth naming rather than pretending it resolves cleanly. Every minute you spend preserving evidence is a minute the attacker is still inside. Sometimes the right call is to burn the evidence and stop the damage — if ransomware is actively encrypting, nobody will thank you for a beautiful memory capture of the machine that encrypted everything while you took it. The point is that this should be a decision you make, out loud, with someone else, and write down. Not a thing that happened because somebody panicked.
Two more that decide how the week goes.
Communicate on a channel the attacker is not in. If they have your mail server, your incident bridge in that mail is being read. Agree the fallback channel before you need it, because agreeing it during is already too late.
And keep a timeline as you go, not afterwards. One shared document, append-only, every action with a UTC timestamp and who did it. It feels like overhead at hour one and it is the only reason you can answer questions at week three — from your own board, from a regulator, or from the person who takes over when you have not slept.