Respond
Short checklists for common incidents, written to use on your phone while it's happening. Pick the one that fits.
- Someone clicked a phishing linkThey clicked, maybe typed a password or opened a file. Work out which, then contain it.
- An email account was taken overMicrosoft 365, Google Workspace or similar. Lock the attacker out and find what they changed.
- Ransomware on a computerFiles encrypted or a ransom note on screen. Isolate first, then get help.
- A password or API key leakedPushed to a public repo, pasted in chat, or found in a breach. Rotate first, clean up second.
- A laptop was lost or stolenLock or wipe it, cut off its access, and work out whether data was exposed.
Incident response frameworks
- NIST SP 800-61 Rev. 3: Incident response recommendations
- SANS: Incident Handler's Handbook
- CISA: Incident and vulnerability response playbooks
- NCSC: Small business guide, response and recovery
- Microsoft: Incident response playbooks
For building your own plan. Each checklist above lists the specific guides it was checked against.
General guidance, not a substitute for your own incident response plan or professional help. When in doubt, call in an expert early: it's cheaper than calling them late.