Incident Response Cheat Sheets: 5 Critical Steps for Digital Emergency Responseage

Follow these steps immediately when an incident occurs: 
 Step 1: STOP & DOCUMENT 
 
 STOP using the affected account or device immediately 
 Don't panic—take a breath and think clearly 
 Take screenshots with full URLs and timestamps (not crops) 
 Document what happened, when you noticed, what you clicked/saw 
 Preserve evidence—don't delete anything, even if embarrassing 
 Save email headers, not just message content 
 
 Why this matters: Your first action is to preserve evidence. Don't inadvertently delete information that can help you recover. 
 Step 2: ACTIVATE YOUR RESPONSE TEAM 
 Call contacts in this order (within 1 hour): 
 
 Incident Commander 
 Technical Lead 
 Communications Lead 
 Executive Contact 
 
 Template message: "We have a security incident involving [brief description]. I've documented what happened. Need immediate coordination—switching to Signal for secure comms." 
 
 Switch to Signal or encrypted channels immediately 
 
 Step 3: SECURE THE SCENE 
 Immediate containment actions: 
 
 Change passwords for affected accounts from a clean device 
 Enable 2FA on all accounts if not already active 
 Disconnect compromised devices from network (unplug ethernet/turn off WiFi) 
 Review recent account activity for unauthorized access 
 Alert personal contacts about potential impersonation 
 
 What NOT to do: 
 
 Don't restart or shut down compromised systems 
 Don't delete suspicious files or emails 
 Don't communicate about the incident over potentially compromised channels 
 
 Step 4: ASSESS THE SCOPE 
 Key questions to answer: 
 
 What data was accessed or compromised? (donor info, strategies, personal data) 
 How many people's data may be affected? 
 What types of data? (contact info, financial, sensitive personal data) 
 Is the incident contained or ongoing? 
 Can we fix it ourselves or do we need external help? 
 Are other organizations or coalition partners affected? 
 
 Step 5: BEGIN RECOVERY 
 
 Restore systems from clean backups 
 Apply security updates and patches 
 Review and strengthen access controls 
 Monitor for continued threats 
 Notify affected individuals if required by law 
 File required regulatory reports 
 Update Board and stakeholders as appropriate