Companion to: Think you've been hacked? What to do in the first hour

One-page incident response plan

Who to call and what to do first if you think you've been hacked. Fill it in right here, then print it or save a PDF or Word copy and keep it away from your computers.

OfficeLast updated

Who to call

Fill this in now, while nothing is wrong. Keep a printed copy somewhere other than your computers.

Who	Name or company	Phone	Notes (after hours, policy or account number)
IT person or IT company
Cyber insurance claims line
Bank fraud department
Person who makes decisions in an incident
Their backup
Lawyer
Local FBI field office

The first hour0/8

Disconnect affected computers from the network (unplug the cable, turn off Wi-Fi), but leave them powered on
Stop using the affected email or accounts to talk about it; use the phone
Call IT, then the insurer, then the bank if money or banking details are involved
Change passwords for affected accounts from a device that was not involved
Do not wipe, reinstall, or delete anything until IT or investigators say so
Write down what happened and when, and photograph any ransom notes or strange messages
Do not pay or reply to a ransom demand before talking with IT, the insurer, and law enforcement
Report the crime to the FBI at ic3.gov

Where things are

Item	Location or details
Backups, and who can restore them
Important accounts master list
Cyber insurance policy and other copies of this plan

Notes

A starting point, not legal advice. Government offices, police departments, and banks may have extra reporting rules. Free from smalltownsysadmin.com

From Small Town Sysadmin. Free to print and share. More at Free checklists.