SAFECOM Members,

We are pleased to announce the publication of the "First 48":  What to Expect When a Cyber Incident Occurs on the SAFECOM Technology resources webpage under "Communications and Cyber Resiliency."

Developed in partnership with public safety officials who have experienced a cyberattack, this document will inform expectations and provide recommendations on how to proceed after experiencing a cyber incident.  The "First 48" presents common themes, insights, and best practices in chronological order.  Expectations, indicators of suspicious activities, and example incident response essential actions are outlined in textboxes to visually aid the understanding and anticipation of cyber incident response.  As responses to specific incidents vary greatly, this document provides foundational guidance on cyber incident response expectations.  The public safety community is encouraged to holistically review their operational posture to ensure that their systems remain resilient in instances of other human-caused or natural disruptions.

The publication of the "First 48" would not have been possible without your help and support, and we sincerely thank you – especially our interviewees – for making the document possible.  We are grateful for your contributions and look forward to continuing working with you on future products.

We encourage you to share the publication email and blog post with your colleagues and others who might be interested in this document.

Thank you again for your continued support of this document.

Regards,

Edward "Ted" Lawson
Cybersecurity and Infrastructure Security Agency
Cell:  (202) 440-1739  |  Email:  Edward.Lawson@cisa.dhs.gov