SANS has links to two cheat sheets for incident handling. One is aimed at server administrators, those who are (hopefully!) most likely to notice issues in the first place. The other is aimed at those who respond to confirmed incidents.
The server admin sheet is mostly what to do and some ways to do it; the handler's sheet is mostly a list of questions to be answered.
The SANS links are to a handler's website, and the result will give you a link to both PDF and Word versions.