Make sure all activity is being logged. Determine the extent and severity of the attack, then figure out the impact on system resources. Notify the right people, from technical and administrative personnel to users to the public. Have a defined response team to ensure that investigative and legal action starts immediately. Contain the problem.
Human safety is the first priority.
After that, protect classified and sensitive data, prevent exploitation of other systems, prevent damage to system files, and minimize disruption of the system. Document all events and evidence on a secure, removable medium. It should be a medium that can be signed and witnessed. Eradicate the problem. First verify that all possible data about the problem has been collected.