Please follow https://gsablogs.gsa.gov/technology/2020/03/10/incident-response-protecting-your-agency-before-and-after-a-cyber-attack/.