R 08

MISSION 08 Advanced 60 min

Incident Response & Recovery

What to do in the first hour after a breach — freezing accounts, preserving evidence, reporting, and rebuilding trust.

// OBJECTIVES

▸ Execute a 60-minute containment playbook end to end
▸ File a complete report with the FTC, IC3, or local equivalent
▸ Restore a compromised account and verify no persistence remains

Topics covered

Recognizing you have been compromised
The first 60 minutes: triage and containment
Preserving evidence without tipping off the attacker
Who to contact: banks, carriers, platforms, law enforcement
Identity-theft recovery and credit freezes
Telling your network without spreading panic
Post-incident hardening checklist

> MISSION BRIEFINGS

// MISSION CHECKLIST 0/7

◁ ABORT TO COURSE ▸ BEGIN MISSION