Incident and attack within your organization

You are an IR team lead and there has been an incident and attack within your organization? What is your plan to deal with the attack? Please describe your process, team organization and governance, decisions that needs to be made, after action reports, and what the organization should do to contain the situation and get people back to work. no plagiarism