# Incident Response Documents, policies, and discussions on incident response that are relevant to civil society and small businesses # Incident Response Plan Template *\[NAME OF ORGANIZATION\]* Effective Date: \[Date\] **Policy Owner:** \[Insert Name\] **Last Updated:** \[Date\] **Review Date:** \[Annual Review Date\] ***IMPORTANT: Print this document and store it in a safe physical location. During an incident, you may not be able to access the digital version.*** # EMERGENCY CONTACT AND COMMUNICATION SHEET *Print this section and keep it accessible for immediate response. Use when you need to act quickly during an emergency.* - Set up a Signal group for your core response team. Fill in contact details below:
RoleContact Information (Name / Phone / Signal)
**Incident Lead**Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Phone: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Signal: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Responsibilities: Overall coordination, external communications authorization, resource allocation*
**Technical Lead**Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Phone: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Signal: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Responsibilities: System analysis, containment, evidence collection, recovery planning*
**Communications Lead**Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Phone: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Signal: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Responsibilities: Media relations, staff notifications, stakeholder updates*
**Legal Contact**Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Phone: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Available hours: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Responsibilities: Law enforcement coordination, legal compliance, breach notification requirements*
**Executive Contact**Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Phone: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Signal: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Responsibilities: Final decisions and authorization*
**Support Coordinator**Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Phone: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Signal: \_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Responsibilities: Staff wellbeing, mental health support, community impact assessment*
**External Support Contacts:**
ContactDetails
**Technical Support**Company: Point of Contact: Phone:
**Groundwire Team**Groundwire Advisors Josh: Signal Galia: galia@groundwireadvisors.com Signal: @galiaN.07 Response time: Within 24 hours
**Law Enforcement**Local Police: \[Phone Number\] Local FBI Office: \[Phone Number\] *It’s preferable to include a cyber-specialize team, if there is one in your area.*
**Cyber Insurance**Company: \[Name\] Phone: \[Phone Number\]
**Mental Health**Provider: \[Name\] Crisis line: \[Phone Number\]
# Communication Protocols During an Incident ## Internal Communications During Incidents - Secure channel activated - Switch to Signal/encrypted email - Key staff notified within 30 minutes - All staff briefed within 2 hours (use secure methods) - Regular updates established (every 2-4 hours during active incident) - Clear guidance provided on what staff should/shouldn't do ## External Communications Guidelines **Key principles:** - All external communications must be approved by Incident Commander - Be transparent but protect sensitive details - Coordinate with legal counsel before public statements - Prioritize affected individuals in notifications - Follow legal notification timelines strictly ## Media Relations If media contact occurs: - Refer all media inquiries to Communications Lead - Prepare holding statement if needed - Coordinate response with legal counsel - Document all media interactions # DETAILED INCIDENT RESPONSE PLAN *This section provides comprehensive checklists and procedures for each phase of incident response. Use this for detailed guidance during and after an incident.* ## Phase 1: Stop the Damage (First 30 Minutes) The first priority is to prevent the incident from getting worse. Act quickly but deliberately. ### Immediate Actions Checklist - STOP - Don't continue using compromised accounts/systems - Disconnect affected devices from internet immediately - Assess safety - Is there immediate physical threat to staff? - Document everything - Screenshot with timestamps before systems change - Preserve evidence - Don't delete anything, even if embarrassing - Change passwords on affected accounts from a clean device - If you don't know which accounts, change all passwords - Activate secure communications - Switch to Signal/encrypted channels - Alert incident lead - Contact primary incident responder immediately - Brief assessment - What type of incident appears to be occurring? ### Special Considerations **If data was shared accidentally:** - Contact recipients to request deletion - Document who received the data and when **If physical theft:** - Report to local police immediately - Change passwords for any accounts accessible from stolen device - Enable remote wipe if possible **For personal targeting/harassment:** - Screenshot all threats with full URLs and timestamps - Don't engage with attackers on social media or email - Check data broker sites for your personal information - Consider temporary social media break if harassment is ongoing ### Initial Notifications (Within 1 Hour) - Incident lead notified - Technical support contacted (if needed) - Legal counsel alerted (if sensitive data involved) - Executive director/senior leadership informed - Key staff who need to know immediately informed - All staff briefed (use secure methods, not compromised email) ## Phase 2: Document Everything (Hours 1-2) Thorough documentation is critical for recovery, legal requirements, and learning. Document in real time—memories fade quickly. ### Core Documentation Checklist - What happened - Detailed description of the incident - When you discovered it - Exact date and time - What systems/data are affected - Complete list - Who has been notified - Names, times, methods of contact - What immediate actions you took - Step-by-step log - Screenshots taken (if safe to do so) ### Evidence Collection Checklist - Full screenshots (not crops) with visible URLs and timestamps - Email headers saved, not just message content - URLs and usernames of accounts involved - Dates/times of all incidents with time zones - Names of any witnesses - System logs exported and saved securely - Access logs reviewed and saved ### Impact Documentation For personal targeting incidents: - Document impact on work, sleep, mental health - Track missed work or reduced productivity - Medical visits or therapy sessions related to incident - Security measures taken (costs incurred) ## Phase 3: Assess Scope (Hours 2-6) Determine the full extent of the incident to guide response priorities and legal obligations. ### System Security Assessment - Identify affected systems - What accounts/systems are compromised? - Review admin access - Check all administrative accounts - Audit recent changes - What was modified in the last 30 days? - Check backup integrity - Are backups clean and recent? - Review access logs - Who accessed what and when? - Scan for malware - Run security scans on affected systems - Update security software - Ensure all protections are current ### Data Protection Assessment - What data was accessed? (Donor info, strategies, personal data) - What data was modified? (Check integrity of important files) - What data was exported? (Check for signs of data theft) - Who is affected? (Staff, donors, partners, community members) - How many people's data may be affected? - What types of data? (Contact info, financial, sensitive personal data) - What are legal obligations? (Breach notification requirements) - Insurance notification - Does cyber insurance need to know? - Whether the incident is contained or ongoing ### Incident Prioritization Matrix Use this matrix to determine response urgency: **HIGH PRIORITY (Address Immediately):** - Public website defaced or down - Email systems compromised - Campaign operations disrupted - Staff unable to work safely - Donor systems affected - Donor payment information exposed - Social security numbers or personal ID info - Medical information of staff/community - Any information about minors **MEDIUM PRIORITY (Address Same Day):** - Internal systems slow/unreliable - Non-critical services interrupted - Individual staff accounts compromised - Social media accounts affected - Internal campaign strategies leaked - Staff personal information exposed - Confidential partner communications **LOW PRIORITY (Address Within 48 Hours):** - Minor harassment targeting individual - Attempted attacks that failed - Suspicious activity with no clear impact - General supporter lists - Public position papers or statements ## Phase 4: Get Help (Hours 2-6) Engage external expertise and coordinate with authorities as appropriate. ### External Support Activation - Contact IT support/consultant - Notify cyber insurance carrier (if applicable) - Engage legal counsel for breach notification guidance - Contact coalition partners if they may be affected - Reach out for mental health support resources ### Law Enforcement Coordination *Note: Whether to contact law enforcement should be determined by the Executive Director, given the current political climate. Consider the following:* **Potential benefits of law enforcement involvement:** - Specialized cyber units have tools to help contain attacks - Can assist in determining method of attack and data recovery - Reporting may help with insurance claims - May be required by state law for certain types of attacks **If contacting law enforcement:** - Contact local police department (see emergency contacts) - Contact local FBI office for cyber incidents (see emergency contacts) - Coordinate with legal counsel on evidence handling - Continue coordination throughout recovery process ### Team Coordination - Incident lead coordinates overall response - Technical responder handles systems/accounts - Communications lead manages messaging - Legal liaison coordinates with attorneys - Support coordinator manages staff wellbeing - Backup personnel identified for each role ## Phase 5: Begin Recovery (Hours 6-24 and Beyond) Restore operations and implement strengthened security measures. ### System Recovery - Restore systems from clean backups - Verify backup integrity before restoration - Apply all security updates and patches - Review and strengthen access controls - Implement additional security measures based on incident - Test restored systems before bringing online - Monitor for continued threats ### Legal Notifications **IMPORTANT: You may have legal obligations if data is stolen. Consult legal counsel immediately. When in doubt about notification requirements, err on the side of transparency.** **You may need to notify authorities if:** - 500+ individuals affected (notify state attorneys general) - Breach involves credit cards (notify card brands and banks) - Health information compromised (notify HHS within 72 hours) - Minors affected (additional state law requirements may apply) **You may need to notify individuals if:** - Personal information likely to result in harm was accessed - Financial information was compromised - Social Security numbers were accessed - State law requires notification (varies by state) **Notification checklist:** - Develop detailed incident timeline - Assess legal notification requirements with counsel - File required regulatory reports - Notify affected individuals as required ### Stakeholder Communications - Plan stakeholder communications - Update Board of Directors - Brief all staff with password change instructions - Notify coalition partners as appropriate - Prepare holding statements for media if needed - Document all response actions taken ## Phase 6: Learning and Improvement (Post-Incident) Every incident is an opportunity to strengthen your security posture. Conduct a thorough review after the immediate crisis has passed. ### Incident Review Process - Conduct incident review meeting with response team - Document what worked well in the response - Identify what could be improved - Review timeline of events and response actions - Assess whether all procedures were followed - Evaluate team coordination and communication ### Security Improvements - Update security procedures based on lessons learned - Implement additional protective measures - Review and update access controls - Enhance monitoring and detection capabilities - Review backup procedures and test restoration ### Training and Awareness - Provide additional staff training based on incident type - Share lessons learned with all staff (appropriately) - Update security awareness materials - Schedule regular security training refreshers ### Plan Updates - Review and update incident response plan - Test updated procedures with tabletop exercises - Update contact lists and escalation procedures - Ensure all staff know where to find updated plan - Schedule annual plan review and update # BUSINESS CRITICAL ASSETS *Identify the systems, networks, and data that are essential to your organization's mission. Understanding what's critical helps you prioritize protection and response efforts.* ### Mission Critical Systems *These systems are responsible for executing functions your organization depends on to meet its stated goals. Failure of these systems may result in a complete inability to continue key operations.* Examples: Email system, donor database, website, advocacy platform Your mission critical systems: --- --- --- --- ### Business Critical Systems *These systems have specific functions in the effective delivery of your organization's service but are not responsible for overall operation. They often focus on management of assets. Failure would disrupt service but not shut down operations entirely.* Examples: HR system, accounting software, internal collaboration tools Your business critical systems: --- --- --- ### Safety Critical Systems *These systems are used to protect the physical safety of your organization's personnel and environment.* Examples: Building access control, surveillance systems, emergency notification system Your safety critical systems: --- --- --- ### Critical Data Assets Identify your most sensitive and valuable data assets: --- --- ## ANNEX: COMMON INCIDENT TYPES This plan applies to incidents including: - **Doxxing attacks** - Personal information published online - **Account compromises** - Unauthorized access to email, social media, or organizational accounts - **Phishing attacks** - Malicious emails targeting staff - **Harassment campaigns** - Coordinated online abuse or intimidation - **Data breaches** - Donor information, strategies, or sensitive documents exposed - **Website attacks** - Site hacked, defaced, or taken offline - **Ransomware** - Digital assets frozen by an attacker - **Surveillance detection** - Discovering monitoring at events or through digital means - **Impersonation** - Fake accounts or profiles pretending to be you/your organization - **Legal threats** - SLAPP suits, subpoenas, or aggressive legal demands - **Physical security concerns** - Threats crossing from digital to real-world safety **Document Version Control** Record all updates to this plan below:
DateUpdated ByChanges Made
# Organizational Incident Response Checklist ## Incident Response Checklist (First 30 Minutes) ### Immediate Actions - [ ] **STOP** - Don't continue using compromised accounts/systems - [ ] **Document everything** - Screenshot with timestamps before systems change - [ ] **Assess safety** - Is there immediate physical threat to staff? - [ ] **Alert incident lead** - Contact primary incident responder immediately - [ ] **Preserve evidence** - Don't delete anything, even if embarrassing - [ ] **Activate secure communications** - Switch to Signal/encrypted channels - [ ] **Brief assessment** - What type of incident appears to be occurring? ### Initial Notifications (within 1 hour) - [ ] Incident lead notified - [ ] Technical support contacted (if needed) - [ ] Legal counsel alerted (if sensitive data involved) - [ ] Executive director/senior leadership informed - [ ] Key staff who need to know immediately ## Organizational Security Incident Checklist ### Team Activation - [ ] **Incident lead** takes charge of coordination - [ ] **Technical responder** handles systems/accounts - [ ] **Communications lead** manages messaging - [ ] **Legal liaison** coordinates with attorneys - [ ] **Support coordinator** manages staff wellbeing - [ ] **Backup personnel** identified for each role ### System Security Assessment - [ ] **Identify affected systems** - What accounts/systems are compromised? - [ ] **Change compromised passwords** immediately - [ ] **Review admin access** - Check all administrative accounts - [ ] **Audit recent changes** - What was modified in the last 30 days? - [ ] **Check backup integrity** - Are backups clean and recent? - [ ] **Review access logs** - Who accessed what and when? - [ ] **Scan for malware** - Run security scans on affected systems - [ ] **Update security software** - Ensure all protections are current ### Data Protection Assessment - [ ] **What data was accessed?** - Donor info, strategies, personal data? - [ ] **What data was modified?** - Check integrity of important files - [ ] **What data was exported?** - Check for signs of data theft - [ ] **Who is affected?** - Staff, donors, partners, community members? - [ ] **What are legal obligations?** - Breach notification requirements? - [ ] **Insurance notification** - Does cyber insurance need to know? ## Incident Prioritization Matrix ### Functional Impact Assessment **High Priority (Address Immediately):** - [ ] Public website defaced or down - [ ] Email systems compromised - [ ] Campaign operations disrupted - [ ] Staff unable to work safely - [ ] Donor systems affected **Medium Priority (Address Same Day):** - [ ] Internal systems slow/unreliable - [ ] Non-critical services interrupted - [ ] Individual staff accounts compromised - [ ] Social media accounts affected **Low Priority (Address Within 48 Hours):** - [ ] Minor harassment targeting individual - [ ] Attempted attacks that failed - [ ] Suspicious activity with no clear impact ### Information Impact Assessment **Critical (Legal/Regulatory Requirements):** - [ ] Donor payment information exposed - [ ] Social security numbers or personal ID info - [ ] Medical information of staff/community - [ ] Any information about minors **High Sensitivity:** - [ ] Internal campaign strategies leaked - [ ] Staff personal information exposed - [ ] Confidential partner communications - [ ] Opposition research or sensitive plans **Medium Sensitivity:** - [ ] General supporter lists - [ ] Public position papers or statements - [ ] Organizational financial information - [ ] Non-sensitive staff communications ## Communication Protocol Checklists ### Internal Communications - [ ] **Secure channel activated** - Switch to Signal/encrypted email - [ ] **Key staff notified** within 30 minutes - [ ] **All staff briefed** within 2 hours (use secure methods) - [ ] **Regular updates scheduled** - frequency depends on severity - [ ] **Roles clarified** - who's handling what aspects - [ ] **Work modifications** - what should staff stop/start doing? - [ ] **Mental health support** offered to affected staff ### External Communications Decision Tree **DO NOT contact external parties until you've answered:** - [ ] Do we understand what happened? - [ ] Have we stopped the immediate problem? - [ ] Do we have legal advice if needed? - [ ] What is our key message? **Media Inquiries:** - [ ] Refer to designated spokesperson only - [ ] Use pre-approved holding statements - [ ] Don't speculate about cause or scope - [ ] Focus on what you're doing to address it - [ ] Emphasize commitment to security and transparency **Partner/Coalition Notifications:** - [ ] Alert partners if they might be affected - [ ] Share technical indicators (IPs, domains) if relevant - [ ] Coordinate messaging if it's a sector-wide issue - [ ] Request additional resources if needed **Law Enforcement Contact:** - [ ] Consult legal counsel first - [ ] Prepare incident timeline and evidence - [ ] Designate single point of contact - [ ] Understand what you're asking for (investigation vs. advice) ## Evidence Preservation Checklist ### Digital Evidence - [ ] **Screenshots with timestamps** of all relevant activity - [ ] **Full email headers** saved, not just message content - [ ] **Browser history** exported before clearing - [ ] **Log files** copied to secure storage - [ ] **Account activity reports** downloaded - [ ] **Social media posts** archived with metadata - [ ] **File system snapshots** of affected computers ### Chain of Custody Documentation For each piece of evidence: - [ ] **What** - Specific description of evidence - [ ] **When** - Date and time collected (with time zone) - [ ] **Who** - Name and role of person collecting - [ ] **Where** - Location/system evidence came from - [ ] **Why** - Relevance to the incident - [ ] **How** - Method used to collect/preserve - [ ] **Chain** - Who has handled it since collection ## Recovery and Lessons Learned Checklists ### System Recovery - [ ] **Malware removed** from all affected systems - [ ] **Vulnerabilities patched** that were exploited - [ ] **Passwords changed** on all potentially affected accounts - [ ] **Access controls reviewed** and updated - [ ] **Backup systems tested** and verified clean - [ ] **Monitoring enhanced** for ongoing threats - [ ] **Security software updated** across all systems - [ ] **Normal operations restored** and tested ### Post-Incident Review (Within 1 Week) - [ ] **Timeline documented** - What happened when? - [ ] **Response effectiveness evaluated** - What worked/didn't work? - [ ] **Root cause identified** - How did this happen? - [ ] **Lessons learned captured** - What would we do differently? - [ ] **Process improvements identified** - What needs to change? - [ ] **Training needs assessed** - Who needs additional training? - [ ] **Policy updates required** - What policies need revision? - [ ] **Follow-up actions assigned** - Who does what by when? ### Prevention Improvements - [ ] **Security awareness training** updated with lessons learned - [ ] **Technical controls enhanced** based on attack vector - [ ] **Monitoring improved** to detect similar attacks faster - [ ] **Response procedures updated** based on what we learned - [ ] **Vendor security reviewed** if third-party systems involved - [ ] **Insurance claims filed** if applicable - [ ] **Regulatory notifications completed** if required ## Quick Reference: When to Escalate ### Immediate Escalation Required - [ ] Any threat of physical violence - [ ] Suspected criminal activity (hacking, stalking, threats) - [ ] Social security numbers or payment card data compromised - [ ] Systems completely down/inaccessible - [ ] Coordinated attack affecting multiple organizations - [ ] Media already reporting on the incident ### Escalate Within 24 Hours - [ ] Email systems compromised - [ ] Donor information potentially accessed - [ ] Website defaced or hijacked - [ ] Staff personal information exposed - [ ] Suspected state-sponsored or sophisticated attack - [ ] Attack methods unknown to your technical team ### Monitor and Address Internally - [ ] Individual staff member receiving harassment - [ ] Password spray attacks that were blocked - [ ] Phishing attempts caught by filters - [ ] Minor social media account compromise - [ ] Suspicious but unsuccessful login attempts ## Emergency Contacts Template **Keep this information readily accessible and secure:** ### Primary Incident Response Team - **Incident Lead:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) - **Technical Lead:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) - **Communications Lead:** \_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) - **Executive Contact:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) ### External Support - **Legal Counsel:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Available: \_\_\_\_\_\_\_\_) - **Technical Support:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) - **Mental Health Support:** \_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Crisis Line: \_\_\_\_\_) - **Coalition Partners:** \_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) ### Emergency Services - **Local Law Enforcement:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_\_) - **FBI Field Office:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_\_) - **State Attorney General:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_\_) - **Crisis Counseling:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_\_) ### Key Account Recovery Information - **Domain Registrar:** \_\_\_\_\_\_\_\_\_\_\_\_\_ (Account: \_\_\_\_\_\_\_, Phone: \_\_\_\_\_\_\_) - **Web Hosting:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Account: \_\_\_\_\_\_\_, Phone: \_\_\_\_\_\_\_) - **Email Provider:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Admin: \_\_\_\_\_\_\_\_, Phone: \_\_\_\_\_\_\_\_) - **Social Media:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Account: \_\_\_\_\_\_\_, Recovery: \_\_\_\_\_\_) *Remember: Print and store this securely. Review and update every 6 months. Practice using these checklists during tabletop exercises.* # Personal Incident Response Checklists ## Incident Response Checklist (First 30 Minutes) ### Immediate Actions - [ ] **STOP** - Don't continue using compromised accounts/devices - [ ] **Document everything** - Screenshot with timestamps before anything changes - [ ] **Assess safety** - Is there an immediate physical threat to you? - [ ] **Preserve evidence** - Don't delete anything, even if embarrassing - [ ] **Activate secure communications** - Switch to Signal/encrypted channels - [ ] **Brief assessment** - What type of incident appears to be occurring? ### Initial Notifications (within 1 hour) - [ ] Technical support contacted (if needed) - [ ] Legal counsel alerted (if sensitive data involved) ## Personal Security Incident Checklist ### If You're Being Targeted - [ ] **Screenshot all threats/harassment** with full URLs and timestamps - [ ] **Don't engage** with attackers on social media or email - [ ] **Change passwords** on all important accounts immediately - [ ] **Enable 2FA** on all accounts if not already active - [ ] **Review recent account activity** for signs of unauthorized access - [ ] **Alert personal contacts** about potential impersonation - [ ] **Check data broker sites** for your personal information - [ ] **Consider temporary social media break** if harassment is ongoing - [ ] **Document impact** on work, sleep, mental health for potential legal action - [ ] **Reach out for support** - to mental health resources and trusted colleagues ### Evidence Collection for Personal Incidents - [ ] Full screenshots (not crops) of all harassment - [ ] Email headers saved, not just message content - [ ] URLs and usernames of accounts involved - [ ] Dates/times of all incidents with time zones - [ ] Names of any witnesses - [ ] Impact documentation (missed work, medical visits, etc.) ## Incident Prioritization Matrix **Critical (Address Immediately):** - [ ] Social security numbers or personal ID info exposed - [ ] Medical information exposed - [ ] Any information about minors exposed **Low Priority (Address Within 48 Hours):** - [ ] Minor harassment targeting you - [ ] Attempted attacks that failed - [ ] Suspicious activity with no clear impact ## Communication Protocol Checklists ### External Communications Decision Tree **DO NOT contact external parties until you've answered:** - [ ] Do I understand what happened? - [ ] Have I stopped the immediate problem? - [ ] Do I have legal advice if needed? - [ ] What is my key message? **Media Inquiries:** - [ ] Don't speculate about cause or scope - [ ] Focus on what you're doing to address it **Groups and Allies You Work With:** - [ ] Alert them if they might be affected - [ ] Share technical indicators (IPs, domains) if relevant - [ ] Request additional resources if needed **Law Enforcement Contact:** - [ ] Consult legal counsel first - [ ] Prepare incident timeline and evidence - [ ] Understand what you're asking for (investigation vs. advice) ## Evidence Preservation Checklist ### Digital Evidence - [ ] **Screenshots with timestamps** of all relevant activity - [ ] **Full email headers** saved, not just message content - [ ] **Browser history** exported before clearing - [ ] **Account activity reports** downloaded - [ ] **Social media posts** archived with metadata ### Chain of Custody Documentation For each piece of evidence: - [ ] **What** - Specific description of evidence - [ ] **When** - Date and time collected (with time zone) - [ ] **Who** - Name of person collecting - [ ] **Where** - Location/account/device evidence came from - [ ] **Why** - Relevance to the incident - [ ] **How** - Method used to collect/preserve - [ ] **Chain** - Who has handled it since collection ## Recovery and Lessons Learned Checklists ### Device and Account Recovery - [ ] **Malware removed** from all affected devices - [ ] **Passwords changed** on all potentially affected accounts - [ ] **Security software updated** on all devices ### Post-Incident Review (Within 1 Week) - [ ] **Timeline documented** - What happened when? - [ ] **Root cause identified** - How did this happen? - [ ] **Lessons learned captured** - What would I do differently? ### Prevention Improvements - [ ] **Insurance claims filed** if applicable ## Quick Reference: When to Escalate ### Get Help Immediately - [ ] Any threat of physical violence - [ ] Suspected criminal activity (hacking, stalking, threats) - [ ] Social security numbers or payment card data compromised - [ ] Media already reporting on the incident ### Get Help Within 24 Hours - [ ] Email account compromised - [ ] Suspected state-sponsored or sophisticated attack ### Monitor and Handle Yourself - [ ] Minor social media account compromise - [ ] Suspicious but unsuccessful login attempts ## Emergency Contacts Template **Keep this information readily accessible and secure:** ### Support Contacts - **Legal Counsel:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Available: \_\_\_\_\_\_\_\_) - **Technical Support:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) - **Mental Health Support:** \_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Crisis Line: \_\_\_\_\_) - **Groups/Allies:** \_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_, Signal: \_\_\_\_\_\_\_\_) ### Emergency Services - **Local Law Enforcement:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_\_) - **FBI Field Office:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_\_) - **Crisis Counseling:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Phone: \_\_\_\_\_\_\_\_\_) ### Key Account Recovery Information - **Email Provider:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Account: \_\_\_\_\_\_\_\_, Phone: \_\_\_\_\_\_\_\_) - **Social Media:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (Account: \_\_\_\_\_\_\_, Recovery: \_\_\_\_\_\_) *Remember: Print and store this securely. Review and update every 6 months.* # Incident Response Cheat Sheets: 5 Critical Steps for Digital Emergency Responseage **Follow these steps immediately when an incident occurs:** ### Step 1: STOP & DOCUMENT - STOP using the affected account or device immediately - Don't panic—take a breath and think clearly - Take screenshots with full URLs and timestamps (not crops) - Document what happened, when you noticed, what you clicked/saw - Preserve evidence—don't delete anything, even if embarrassing - Save email headers, not just message content *Why this matters: Your first action is to preserve evidence. Don't inadvertently delete information that can help you recover.* ### Step 2: ACTIVATE YOUR RESPONSE TEAM **Call contacts in this order (within 1 hour):** 1. Incident Commander 2. Technical Lead 3. Communications Lead 4. Executive Contact **Template message:** *"We have a security incident involving \[brief description\]. I've documented what happened. Need immediate coordination—switching to Signal for secure comms."* - **Switch to Signal or encrypted channels immediately** ### Step 3: SECURE THE SCENE **Immediate containment actions:** - Change passwords for affected accounts from a clean device - Enable 2FA on all accounts if not already active - Disconnect compromised devices from network (unplug ethernet/turn off WiFi) - Review recent account activity for unauthorized access - Alert personal contacts about potential impersonation **What NOT to do:** - Don't restart or shut down compromised systems - Don't delete suspicious files or emails - Don't communicate about the incident over potentially compromised channels ### Step 4: ASSESS THE SCOPE **Key questions to answer:** - What data was accessed or compromised? (donor info, strategies, personal data) - How many people's data may be affected? - What types of data? (contact info, financial, sensitive personal data) - Is the incident contained or ongoing? - Can we fix it ourselves or do we need external help? - Are other organizations or coalition partners affected? ### Step 5: BEGIN RECOVERY - Restore systems from clean backups - Apply security updates and patches - Review and strengthen access controls - Monitor for continued threats - Notify affected individuals if required by law - File required regulatory reports - Update Board and stakeholders as appropriate