What to do in the first hour of an IT emergency.

Why the first hour matters

Most of the damage in an IT emergency is decided early. A ransomware infection that is contained to one machine is a bad afternoon; one that spreads across a file server and its backups is a business-stopping event. The same applies to an outage or a locked-out tenant: the first decisions about what to switch off, what to keep and who to tell shape everything that follows. This checklist is written for owners, office managers and finance leads, not just IT staff. Print it and keep it where you can find it when systems are down.

Step 1: stay calm and name one person in charge

Pick a single incident lead. Everyone else reports to that person and nobody improvises. Start a written log straight away: what was noticed, by whom, at what time, and every action taken afterwards. A phone note is fine. The log is useful to your IT provider, your insurer and your own management later, and it stops people repeating or undoing each other's work.

Step 2: isolate, do not switch off

The aim is to stop the problem spreading while keeping evidence intact.

• Disconnect affected computers from the network: unplug the network cable and turn off Wi-Fi. Do not shut them down or restart them unless told to by your provider, as memory and logs can hold useful evidence.
• If you cannot tell which machines are affected, disconnect the office from the internet at the router or firewall, and isolate shared file servers.
• Disconnect backup drives and network backup devices that are attached to the affected systems, so they cannot be encrypted or overwritten.
• Suspend any compromised account: change its password from a clean device and sign it out of all sessions. For Microsoft 365, ask your administrator to block sign-in and revoke sessions.

Step 3: preserve what you can

Resist the urge to tidy up. Do not delete the ransom note, suspicious emails or odd files, and do not run clean-up tools or reinstall anything before someone competent has looked. Photograph screens with a phone, note any error messages exactly as written, and record which files or systems are affected. If the problem is an outage rather than an attack, note what changed just before it started: an update, a new device, a power event, a change by a supplier.

Step 4: who to call

Work down this list in order and write the time of each call in the log.

1. Your IT provider or in-house IT lead. Tell them what stopped, when, and what you have already disconnected.
2. Your internet, hosting or software suppliers if the failure looks like it sits with them.
3. Your senior management or business owner, so decisions on trading and communications are made by the right people.
4. Your cyber insurer, if you hold a policy. Many policies expect early notice and specify who must handle the response, so read yours before you hire anyone.
5. Your legal adviser, if personal or customer data may be involved.

If you do not have a provider, you do not need a contract to get help in an emergency. Our emergency IT support page shows how to reach us, and the engineers there will triage the problem with you.

Step 5: communicate early and carefully

Staff need a short, factual instruction: which systems not to use, which not to plug in, and who to ask. Send it by a route that does not depend on the affected systems, such as a phone call, a messaging group or text message, because email may be compromised or down. Tell customers and suppliers only what is confirmed, and agree one spokesperson. Do not speculate about the cause or the data involved until it has been established, and do not discuss the incident on open social channels.

If personal data may have been exposed, there may be notification and record-keeping duties under UAE law or sector rules. We cannot give legal advice here, but our UAE PDPL basics guide explains the general picture, and your legal adviser should confirm what applies to you and to whom you must report.

What not to do

• Do not pay a ransom or reply to the attacker before getting advice. Payment does not guarantee recovery and may carry legal and insurance consequences.
• Do not wipe or reinstall machines before evidence is preserved and the cause is understood.
• Do not reconnect an affected machine "just to check" a file.
• Do not restore from backup onto a network that is still compromised. The restored data can be hit again.
• Do not use the same email system to coordinate if it may be compromised.
• Do not assume it is over once systems come back. The way in must be found and closed.

When to escalate to a specialist provider

Call for outside help straight away if any of the following is true: files are encrypted or renamed, a ransom note has appeared, an administrator or finance account is behaving oddly, a server has failed and you are unsure of the state of your backups, more than one site or department is affected, or you cannot tell what is happening. Waiting to see whether it clears usually makes recovery harder. The earlier an experienced engineer is involved, the more options you keep.

After the first hour

Once the situation is contained, the work moves to recovery and learning. Our ransomware recovery planning guide covers how to structure recovery after an attack, and the disaster recovery plan guide explains how to prepare recovery steps and priorities before anything goes wrong. A written plan, tested backups and a named contact list turn this checklist from improvisation into routine.

If you are not sure how exposed you are today, the free IT health check reviews backup, security and support arrangements and gives you a prioritised list. Missan Global has supported UAE organisations from its Al Majaz, Sharjah head office since 2004.