INCIDENT RESPONSE

First-Hour Checklists

If you suspect account compromise or ransomware, open the matching checklist below. Follow the first steps, avoid the actions that destroy evidence, and know when to call for help.

If you are under active attack

Contact your IT provider and your cyber insurer first. To report a cybercrime in the U.S., file a complaint with the FBI IC3. These checklists are guidance, not a substitute for professional incident response.