Incident Response Checklists
Actionable steps for the moment something is happening — not policy, a runbook.
🔒 Ransomware
Files are encrypted, inaccessible, or you're seeing a ransom note.
💸 Business Email Compromise / Wire Fraud
A fraudulent payment was made, or you suspect a compromised email led to a wire transfer request.
📱 Lost or Stolen Device
A laptop, phone, or other device with organizational access is missing.
📧 Compromised Email Account
An email account may have been accessed by someone unauthorized (phishing, credential theft, suspicious login).
🗃️ Data Breach (General)
You suspect or have confirmed that data was accessed, exposed, or exfiltrated without authorization.