Incident Response
When an account is taken over or a device goes missing, the first hours count. What to do, who to tell, and how to recover and learn from it.
Jump to the playbooks
Playbooks
Short steps for the first hours, named by what's happening.
-
Account taken over
Getting back into a hijacked email, messaging or social media account, then closing the way in so it doesn't happen again.
-
Device lost or seized
The first hours after a phone or laptop goes missing or is taken: what to lock, what to change and what to write down.
-
Clicked a bad link
Someone clicked a suspicious link or opened an attachment. What to check, what to change and who to tell.
-
Details posted online
A colleague's personal details have been published. What to do first, how to get them taken down and how to support them.
If none of these fit
- Tell the right person first
- Write down what happened, and when
- Leave accounts and devices as they are until you know more
- Use SIIRF's incident playbooks for what these four don't cover, such as ransomware, data breaches, website attacks and internet shutdowns
- Ask Access Now's Digital Security Helpline for help: it's free for civil society, day and night
Write your plan while things are calm
Who does what, who to call and where your records live, agreed before anyone needs them.
Your incident response plan