A checklist produces value when each item has an owner, evidence, a due date, and an explicit exception path.
Record evidence and renewal dates—not just star ratings.
Use a known device or contact path. Do not paste passwords, recovery codes, identity numbers, or confidential records into an online checker.
01 / Read the situation
Separate the signal from the story.
A surprising event is a reason to verify, not proof of a specific cause. Record what you observed, when it happened, and which account, device, record, or person is affected. Then confirm through a channel you already trust.
The related pathways explain the risk and tradeoff behind the action this kit records. Continue with Small-business cyber risks, Protecting customer data, and Cyber insurance checklist.
Start with reversible containment. Keep evidence. Avoid making a rushed change that destroys logs or locks you out of recovery.
Three questions before you act
- What exactly changed?Distinguish a message about an event from evidence inside the real account or system.
- What can this access unlock?Prioritize email, phone, finance, administrator access, and recovery channels.
- Can I verify independently?Use a saved number, official app, typed address, or accountable person—not details supplied by the alert.
02 / The action plan
Move from containment to confidence.
The sequence below is deliberately broad enough to stay useful as interfaces change. Provider-specific buttons move; the security objective does not.
- 01
Print or copy the checklist into the system you actually use
Start with the highest-impact access or data in scope and avoid using a link from an unexpected message.
- 02
Name the person responsible for each action
Use dates, case numbers, screenshots, owners, and decisions so another person can follow what happened.
- 03
Attach evidence or a short decision note
Choose the smallest effective control, confirm it took effect, and protect its recovery path.
- 04
Escalate blocked or risky exceptions
Use the provider or authority appropriate to the affected account, record, jurisdiction, or workplace.
- 05
Date the review and schedule the next one
Schedule a follow-up. Many problems reappear through unchanged recovery details, connected apps, or stale copies.
03 / Decision table
Turn warning signs into specific checks.
| Signal | What it may mean | Safer next step |
|---|---|---|
| Checklist without owner | Work is assumed, not completed | Assign one accountable person |
| No evidence | Cannot verify or repeat | Record setting, date, or test result |
| Never revisited | Configuration drifts | Set a recurring review |
For live incidents, verify steps with the affected provider and the relevant government or regulatory authority. Product screens, laws, reporting routes, and eligibility can change by place and time.
04 / Common questions
What people ask next.
Can I use these kits for compliance?+
They can help organize work, but they do not certify compliance or replace requirements specific to your jurisdiction, contract, or assessor.
Should every item be mandatory?+
No. Record why an item is not applicable or how another control addresses the same risk.
When should I get professional help?+
Escalate when safety is at risk, money or regulated data is involved, an attacker may still have access, legal deadlines apply, business operations are affected, or you cannot confidently preserve evidence and recover.