Handling cyber security incidents typically involves a process known as incident response. The incident response process typically includes the following steps:

1. Preparation: Establishing an incident response plan and assembling a team to carry out the plan.
2. Identification: Detecting and identifying a security incident.
3. Containment: Taking steps to stop the incident from spreading.
4. Eradication: Removing the cause of the incident.
5. Recovery: Restoring normal system operations.
6. Lessons learned: Analyzing the incident to identify what went wrong and what can be done to prevent similar incidents in the future.

It’s important to have an incident response plan in place and the team should be well-trained and educated in advance before any incident happens. And also it’s good practice to perform regular incident response exercises to test the plan and the team’s readiness.