Personal Incident Response Checklists

Incident Response Checklist (First 30 Minutes)

Immediate Actions

• STOP - Don't continue using compromised accounts/devices
• Document everything - Screenshot with timestamps before anything changes
• Assess safety - Is there an immediate physical threat to you?
• Preserve evidence - Don't delete anything, even if embarrassing
• Activate secure communications - Switch to Signal/encrypted channels
• Brief assessment - What type of incident appears to be occurring?

Initial Notifications (within 1 hour)

• Technical support contacted (if needed)
• Legal counsel alerted (if sensitive data involved)

Personal Security Incident Checklist

If You're Being Targeted

• Screenshot all threats/harassment with full URLs and timestamps
• Don't engage with attackers on social media or email
• Change passwords on all important accounts immediately
• Enable 2FA on all accounts if not already active
• Review recent account activity for signs of unauthorized access
• Alert personal contacts about potential impersonation
• Check data broker sites for your personal information
• Consider temporary social media break if harassment is ongoing
• Document impact on work, sleep, mental health for potential legal action
• Reach out for support - to mental health resources and trusted colleagues

Evidence Collection for Personal Incidents

• Full screenshots (not crops) of all harassment
• Email headers saved, not just message content
• URLs and usernames of accounts involved
• Dates/times of all incidents with time zones
• Names of any witnesses
• Impact documentation (missed work, medical visits, etc.)

Incident Prioritization Matrix

Critical (Address Immediately):

• Social security numbers or personal ID info exposed
• Medical information exposed
• Any information about minors exposed

Low Priority (Address Within 48 Hours):

• Minor harassment targeting you
• Attempted attacks that failed
• Suspicious activity with no clear impact

Communication Protocol Checklists

External Communications Decision Tree

DO NOT contact external parties until you've answered:

• Do I understand what happened?
• Have I stopped the immediate problem?
• Do I have legal advice if needed?
• What is my key message?

Media Inquiries:

• Don't speculate about cause or scope
• Focus on what you're doing to address it

Groups and Allies You Work With:

• Alert them if they might be affected
• Share technical indicators (IPs, domains) if relevant
• Request additional resources if needed

Law Enforcement Contact:

• Consult legal counsel first
• Prepare incident timeline and evidence
• Understand what you're asking for (investigation vs. advice)

Evidence Preservation Checklist

Digital Evidence

• Screenshots with timestamps of all relevant activity
• Full email headers saved, not just message content
• Browser history exported before clearing
• Account activity reports downloaded
• Social media posts archived with metadata

Chain of Custody Documentation

For each piece of evidence:

• What - Specific description of evidence
• When - Date and time collected (with time zone)
• Who - Name of person collecting
• Where - Location/account/device evidence came from
• Why - Relevance to the incident
• How - Method used to collect/preserve
• Chain - Who has handled it since collection

Recovery and Lessons Learned Checklists

Device and Account Recovery

• Malware removed from all affected devices
• Passwords changed on all potentially affected accounts
• Security software updated on all devices

Post-Incident Review (Within 1 Week)

• Timeline documented - What happened when?
• Root cause identified - How did this happen?
• Lessons learned captured - What would I do differently?

Prevention Improvements

• Insurance claims filed if applicable

Quick Reference: When to Escalate

Get Help Immediately

• Any threat of physical violence
• Suspected criminal activity (hacking, stalking, threats)
• Social security numbers or payment card data compromised
• Media already reporting on the incident

Get Help Within 24 Hours

• Email account compromised
• Suspected state-sponsored or sophisticated attack

Monitor and Handle Yourself

• Minor social media account compromise
• Suspicious but unsuccessful login attempts

Emergency Contacts Template

Keep this information readily accessible and secure:

Support Contacts

• Legal Counsel: _________________ (Phone: ________, Available: ________)
• Technical Support: ______________ (Phone: ________, Signal: ________)
• Mental Health Support: __________ (Phone: ________, Crisis Line: _____)
• Groups/Allies: _____________ (Phone: ________, Signal: ________)

Emergency Services

• Local Law Enforcement: _________________ (Phone: _________)
• FBI Field Office: _____________________ (Phone: _________)
• Crisis Counseling: ____________________ (Phone: _________)

Key Account Recovery Information

• Email Provider: ______________ (Account: ________, Phone: ________)
• Social Media: _______________ (Account: _______, Recovery: ______)

Remember: Print and store this securely. Review and update every 6 months.