Emergency Action Rules
- Never Power Off Systems: Disconnect Ethernet cables and disable Wi-Fi, but keep systems powered on—volatile RAM memory holds encryption keys and essential forensic artifacts.
- 24-Hour Legal Reporting Clock: Covered entities under Art. 74b ISA must report the incident to FOCS within 24 hours of confirmation.
- Refuse Ransom Demands: Paying ransoms finances international organized crime, provides zero recovery guarantees, and marks your company for repeat extortion.
| Timeline | Priority Action | Responsible Party |
|---|---|---|
| 0 – 1 hour | Physical Isolation: Disconnect all network cables, drop Wi-Fi networks, and terminate site-to-site VPN links immediately. | IT Systems Administrator |
| 1 – 3 hours | Activate Crisis Committee: Assemble Executive Board, Legal Counsel, and external incident response specialists using secure out-of-band communications. | Executive Board / CEO |
| 3 – 6 hours | Sanctuary Backups: Physically secure offline backup media before any restoration attempt to prevent re-infection. | Infrastructure Lead |
| 6 – 12 hours | Preliminary Forensics: Determine initial access vector (patient zero, compromised account) and assess data exfiltration scope. | Digital Forensics Lead (Suisse IT) |
| 12 – 24 hours | Statutory Filings: Submit official notification to FOCS (Art. 74b ISA), notify FDPIC if personal data is breached (Art. 24 revFADP), and file criminal complaints with Cantonal Police. | Legal Counsel / DPO |
