Incident Response

Response Steps

What to Do First

01

Identify

Confirm what happened, when it started, and which accounts, devices, or users may be affected.

02

Contain

Disconnect affected devices if needed, isolate compromised accounts, and stop the threat from spreading.

03

Preserve Evidence

Keep screenshots, suspicious emails, timestamps, and system notes that may support later investigation.

04

Recover

Restore trusted access, reset credentials, monitor for recurrence, and review what needs to change.

Ready to Escalate?

Use the report pathway to share the incident details with the right context and urgency.

Report Incident