Synchronizing technical response and compliance
The first 24 hours after detecting a cyberattack are critical for an organization. IT specialists' attempts to quickly restore system operations often result in the destruction of digital evidence (volatile data) in temporary memory. This complicates the investigation and makes it impossible to inform regulators in a timely manner.
According to the ENISA Threat Landscape 2025 report, 53.7% of all affected entities are organizations subject to the NIS2 directive. Violating reporting deadlines risks fines for companies, so technical containment of the threat must run parallel to the legal preservation of evidence.
What this means for the market
For the IT and software industry, these requirements mean that technical disaster recovery can no longer be handled in isolation from legal compliance. Companies must restructure their incident response workflows to ensure that evidence preservation and regulatory reporting occur simultaneously, preventing severe financial penalties and loss of digital forensics.
Threat containment under NIST and MITRE ATT&CK standards
According to the NIST CSF 2.0 framework, the primary task during a response is threat containment, not full recovery. It is recommended to adhere to the following rules:
- Logical isolation: instead of powering off servers (which destroys data in RAM), network isolation should be applied at the EDR or firewall level.
- Memory imaging: creating a copy of RAM before starting any destructive actions.
- Identity control: immediate blocking of compromised accounts.
The MITRE ATT&CK matrix is used to quickly assess the scale of the attack. It allows mapping attackers' techniques and proactively blocking threats at the domain level, relying on standardized concepts.
NIS2 directive requirements and architectural resilience
The NIS2 directive requires essential organizations to submit an early warning report within 24 hours of detecting an incident. The report must state the occurrence of the event, its preliminary nature, and an assessment of its cross-border impact.
To prevent chaos, security must be built-in at the architectural level (Security by Design). Using platforms like UnityBase allows automating audit logging (Audit Trail) and implementing access control (RBAC/RLS). Developing solutions according to the ISO/IEC 42001:2023 standard further minimizes the attack surface during integrations.
Hour-by-hour action plan for the first day
- 0–2 hours: activation of the response team, logical isolation of hosts while preserving RAM, launching a backup communication channel.
- 2–6 hours: identifying tactics using MITRE ATT&CK, aggregating logs, detecting compromised accounts.
- 6–12 hours: blocking accounts, changing keys, creating forensic images.
- 12–18 hours: assessing business impact and compliance with NIS2/GDPR requirements.
- 18–24 hours: sending the early warning report to the regulator and starting communication with clients.
Steps for businesses
To prepare your organization for a cyber incident, take these immediate practical steps:
- Deploy EDR solutions that support logical network isolation instead of physical power-offs to preserve volatile RAM data.
- Integrate automated audit logging (Audit Trail) and robust access controls at the architectural level of your software products.
- Train your security and legal teams to execute the structured 24-hour hour-by-hour response plan in tandem.
Prepared by a Software Ukraine member. Original publication.