Prevent
Respond fast, preserve evidence, reduce downstream damage.
The first hours after discovery determine whether the event becomes actionable. Stabilize operations, preserve evidence, and file a clean incident packet.
First hours
Immediate actions (first 2–4 hours)
Preserve the scene
Limit access to affected zones. Photograph gate damage, tire tracks, and staging conditions. Note who was present and when.
Secure evidence
Export relevant footage with timestamps. Collect access logs, load sheets, seal logs, and shift reconciliation records.
Stabilize operations
Confirm what product is missing, what is in motion, and where custody changed. Hold shipments when a variance can’t be reconciled quickly.
Escalate and document
Notify internal leadership and the designated liaison. Create a written timeline and assemble an incident packet for investigators.
Do not overwrite evidence
If retention is short, export footage immediately. Ensure recorders are not set to overwrite the relevant time window before the export is complete.