The first steps when facing an incident are the immediate reactions that limit damage: stay calm, do not power off or erase anything, disconnect the device from the network, alert the responsible person or department, note what happened, and change the affected passwords from a clean device.
Example
Unplug the network cable of a computer suspected of infection, then call support.