This Note discusses common cyberattack scenarios and sets out actions that organizations can take to prevent and respond to attacks, including developing a cyber incident response plan. It also addresses the role of the chief information security officer (CISO) or other designated responsible employees in preventing and containing attacks and making law enforcement referrals, and civil and criminal actions organizations can pursue against attackers.