Prepare for an incident
Want more background?
The idea in everyday life
Write the response while calm: disconnect affected devices when appropriate, preserve evidence, change credentials from a clean device, revoke sessions, contact providers through official channels, monitor financial or identity misuse, and document actions. Sequence depends on the incident.
Contain, regain control, preserve evidence, recover, then learn.
One step at a time.
Use the sample or information you have permission to use. Keep your work as you go. You can pause between steps.
- 1
Write the response order: secure email, reset affected passwords or other sign-in details, sign out existing sessions, contact providers, and stop further financial loss.
- 2
Keep account numbers, device identifiers, insurer contacts, and official fraud-reporting resources offline.
- 3
If compromise occurs, use a known-clean device and official URLs; document times, messages, transactions, and case numbers.
- 4
After recovery, identify the entry point and update controls rather than only changing one password.
See how it works.
After an unexpected email-login alert, Sam uses a clean phone to open the provider directly, changes the password, revokes sessions and app tokens, inspects forwarding rules, confirms recovery methods, checks related accounts, saves alert details, and warns contacts if messages were sent.
Did you cover these?
- Official recovery and fraud contact routes are available without the compromised device.
- The checklist distinguishes lost device, stolen account, payment fraud, and malware.
- Actions, times, confirmation numbers, and evidence are recorded.
What to finish
A one-page incident card that can be used even when your main phone and email are unavailable.
Watch for this
Responding through the same compromised email thread or device without first securing the master account.
How can I tell I understand it?
You can name the first five actions for a lost phone, stolen email, or suspicious bank transfer.
Quick knowledge check
Answer all 3 questions. Get at least 2 right and the lesson completes automatically.
You’ll get an explanation for each answer. Signed in? Your results save to your account.
Pass the check. We’ll save the progress.
Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.
Go to the knowledge checkOptional course overview video · same video as Lesson 1
Secure Our World
From Cybersecurity and Infrastructure Security Agency. Watch here or open it on YouTube .
Turn the playlist's protective actions into a one-page incident checklist with provider-specific recovery links and an order you can follow under stress.Tools, templates, and lesson sources
Tools and templates
Tools open in a new tab so you can keep your place here.
Sources and further reading
Explore the references behind this lesson.
Report a problem with this lesson
Tell us what went wrong. Please leave out personal information and private project contents.