CyberCode.ph · Philippines

Cyber Incident Response Checklist Philippines | CyberCode

Last updated September 25, 2026 · Practical privacy, cybersecurity and technology-law guidance
Cyber incident response checklist and incident documentation

Last materially reviewed: September 25, 2026

Direct Answer

CyberCode’s Philippines cyber incident response checklist sets out what a Philippine organisation should do in the first 72 hours: establish the incident timeline, preserve evidence, contain the threat, scope personal data, assess notification, and record each decision. Work from top to bottom and assign every action a named owner and timestamp. For the full incident response plan, governing law and NPC notification duty, use the companion guide linked below.

The First 72 Hours

First actions: (1) confirm and timestamp the alert; (2) appoint an incident lead and involve the DPO if personal data may be involved; (3) use a clean communication channel; (4) preserve readily available logs and evidence; (5) contain active access without wiping devices; and (6) assess affected people, reporting duties and recovery. Do not wait for a complete forensic report before taking urgent protective action.

Hour 0 — Fix the clock

  • Record two separate timestamps, with timezone: when the security alert was first noticed and when the personal information controller or processor knew of or reasonably believed that a personal data breach had occurred. The NPC 72-hour notification period relates to the latter knowledge or reasonable belief for a breach requiring notification, not automatically to every suspicious click or security alert. Record what facts supported the conclusion and when they became known.
  • Record who reported it, how, and the verbatim first description.
  • Name one incident lead. One person, not a committee.
  • Open a single running decision log. Every entry gets a time, an action, a person and a reason.

Hour 0–2 — Assemble and assess

  • Convene the breach response team and confirm someone present can authorise immediate critical action without escalating further.
  • Bring in the Data Protection Officer now, not after containment.
  • Switch to an out-of-band communication channel — personal phones or a separate messaging service — if email or chat may be compromised.
  • Answer one question in writing: is the attacker still active?
  • Notify management and, where relevant, your cyber insurer and external counsel. Insurance and vendor contracts may set separate, shorter notice deadlines.

Hour 0–4 — Preserve before you contain

Preserve first where it is safe and practical: the original suspicious email or message with headers and URLs; alert and ticket timestamps; identity and MFA sign-in records; mail-forwarding rules; cloud audit and data-export logs; firewall, VPN, web and endpoint logs; affected file names and system configurations; payment or transaction records; screenshots and witness accounts. Record who collected each item, when, from where and any hash or chain of custody. A trained responder should decide whether memory capture or a disk image is needed. If an attacker is active, do not delay isolation merely to complete forensic imaging.

  • Export authentication, firewall, web server, mail and endpoint logs to separate write-protected storage. Containment frequently rotates or destroys them.
  • Compute and store a cryptographic hash of every exported file at the moment of export.
  • If trained responders can do so safely without delaying urgent containment, capture volatile memory before shutting down an affected host; record why it could not be captured when necessary.
  • Where a forensic image is needed, have a qualified responder image relevant disks or snapshots and record the tool, version, operator and hash. Preserve an original copy and investigate a working copy.
  • Start a chain-of-custody record for every device and file: who held it, when, what they did, who they passed it to.
  • Screenshots are supporting illustration only. Always preserve the underlying log or export as the actual record.

Hour 2–8 — Contain

Contain in order: isolate affected endpoints or services from the network without wiping them; from a clean administrator device revoke sessions and tokens and disable compromised access; block known malicious indicators; verify unaffected backups; then rotate affected credentials and monitor for renewed access. Preserve logs and a copy of relevant configurations before a change when doing so will not prolong harm. Write down every change, owner and time so the investigation can distinguish attacker activity from the response.

  • Isolate affected hosts from the network without wiping them.
  • Disable compromised accounts and revoke active sessions, refresh tokens and API keys.
  • Rotate credentials for affected accounts, service accounts and any shared secrets.
  • Enforce multifactor authentication on administrative and remote access if it is not already mandatory.
  • Block known malicious domains, addresses and indicators.
  • Verify your backups are intact, offline or immutable, and not reachable from the compromised environment.
  • Record every containment action with its authoriser and exact time.

Hour 4–24 — Scope the personal data

Record the data scope: the controller and any processor; affected systems, locations and vendors; whether the event affected confidentiality, integrity or availability; names and categories of people (customers, staff, applicants or vulnerable groups); categories of ordinary and sensitive personal information; credentials, financial details, IDs or other data usable for identity fraud; the approximate number of people and records; evidence of access, acquisition, alteration, exfiltration or loss; likely harm; and how each estimate was made. Update the assessment as facts change.

  • Identify which systems and datasets were reachable by the attacker.
  • List the categories of personal data involved and whether any is sensitive personal information.
  • Estimate the number of affected data subjects and records, and record the basis for the estimate.
  • Check for exfiltration evidence: unusual outbound volume, staging archives, cloud sync activity, transfers you cannot account for.
  • Check for persistence and lateral movement — new accounts, scheduled tasks, altered access rules.
  • Identify any third-party processor or vendor whose environment is implicated.

Hour 12–36 — Decide and draft

NPC notification test: mandatory notification generally requires all three elements: (1) sensitive personal information or other information that could enable identity fraud is involved; (2) there is reason to believe an unauthorized person acquired it; and (3) the personal information controller believes the breach is likely to create a real risk of serious harm to affected people. Apply the test to available evidence, document a non-notification decision, and revisit it if new facts emerge. The controller remains accountable even when a processor or cloud vendor is involved. See the NPC breach reporting guidance.

  • Assess in writing whether the incident is a notifiable personal data breach, addressing each element separately and recording your reasoning either way.
  • If notifiable, confirm your organisation’s access to the NPC filing portal now — do not discover a login problem at hour 70.
  • Draft the regulator notification and the notice to affected data subjects in parallel.
  • Decide separately whether the incident is also a crime to be reported to law enforcement. That is a distinct track from the privacy notification and neither substitutes for the other.
  • Prepare holding statements for staff and customers, and confirm who is authorised to speak.

Hour 24–72 — File, notify, stabilise

What goes in the NPC notice? The DBNMS personal data breach notification form asks for the controller or representative, occurrence and discovery dates if known, a short account and chronology, why the mandatory-reporting conditions apply, how the breach happened and the affected system, the type and approximate number of people and records, data categories including sensitive information or identity-fraud risks, likely consequences, DPO or contact details, steps taken to contain and recover, measures to prevent recurrence, and how affected people were or will be informed. Mark unknown facts as pending and submit available information on time. See the NPC form guidance.

Who else should be notified? When a breach meets the notification criteria, the controller must also notify affected data subjects under the applicable NPC rules, with practical harm-reduction advice. Report suspected crimes to an appropriate law-enforcement channel and seek CERT-PH assistance when useful; those are separate routes, not substitutes for an NPC filing. Check sector, contractual, insurer and payment-provider notice duties as well.

  • If the breach meets the mandatory notification test, submit the personal data breach notification through the NPC DBNMS portal within the applicable 72-hour period. Submit available information even if the investigation is incomplete, then update the same case under NPC procedure. For a non-notifiable incident, document the assessment and follow applicable annual incident reporting rules.
  • Save the submission reference and timestamp the system returns.
  • When notification is required, notify affected data subjects individually within the applicable period, with a contact and practical steps to reduce harm. If a delay or alternative method is needed, use the NPC request process rather than silently postponing notice.
  • Report to law enforcement or request technical assistance from CERT-PH where applicable.
  • Begin eradication and recovery: remove the root cause, patch what was exploited, rebuild from trusted images, restore from verified clean backups.
  • Monitor closely for recurrence and re-entry before returning systems to full production.
  • Diarise the post-incident review and the corrective actions with named owners and deadlines.

Do not do these after a cyber incident

What should an organisation avoid? Do not erase logs, wipe devices or reset everything before preserving available evidence; do not leave compromised accounts active while investigating; do not publish unverified claims about exposure; do not pay or negotiate through an unverified contact; do not send personal data to outside responders without appropriate safeguards; and do not assume a vendor, CERT-PH or police report satisfies the controller’s NPC duty. Record urgent exceptions and why they were necessary.

  • Do not wipe or rebuild before evidence is preserved.
  • Do not wait for forensic certainty before starting the notification assessment.
  • Do not assume a police or CERT-PH report discharges your privacy notification duty.
  • Do not assume a vendor’s breach is only the vendor’s problem to report.
  • Do not leave a decision not to notify undocumented.

For the Full Plan and the Law

Official online filing source: The National Privacy Commission breach-reporting page explains the rules and links to its Data Breach Notification Management System (DBNMS). The NPC says personal data breach notification forms must be submitted through DBNMS; an email, police report or CERT-PH request is not a substitute.

This page is the operational checklist only. The 72-hour notification duty under NPC Circular 16-03, what makes a breach notifiable, the required notification contents, the response team requirement, penalties and the Annual Security Incident Report are all covered in our Cybersecurity Incident Response Plan for the Philippines.

Official Sources

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.