Six steps for responding to a disruptive attack