Personal Incident Response Checklists Incident Response Checklist (First 30 Minutes) Immediate Actions STOP - Don't continue using compromised accounts/devices Document everything - Screenshot with timestamps before anything changes Assess safety - Is there an immediate physical threat to you? Preserve evidence - Don't delete anything, even if embarrassing Activate secure communications - Switch to Signal/encrypted channels Brief assessment - What type of incident appears to be occurring? Initial Notifications (within 1 hour) Technical support contacted (if needed) Legal counsel alerted (if sensitive data involved) Personal Security Incident Checklist If You're Being Targeted Screenshot all threats/harassment with full URLs and timestamps Don't engage with attackers on social media or email Change passwords on all important accounts immediately Enable 2FA on all accounts if not already active Review recent account activity for signs of unauthorized access Alert personal contacts about potential impersonation Check data broker sites for your personal information Consider temporary social media break if harassment is ongoing Document impact on work, sleep, mental health for potential legal action Reach out for support - to mental health resources and trusted colleagues Evidence Collection for Personal Incidents Full screenshots (not crops) of all harassment Email headers saved, not just message content URLs and usernames of accounts involved Dates/times of all incidents with time zones Names of any witnesses Impact documentation (missed work, medical visits, etc.) Incident Prioritization Matrix Critical (Address Immediately): Social security numbers or personal ID info exposed Medical information exposed Any information about minors exposed Low Priority (Address Within 48 Hours): Minor harassment targeting you Attempted attacks that failed Suspicious activity with no clear impact Communication Protocol Checklists External Communications Decision Tree DO NOT contact external parties until you've answered: Do I understand what happened? Have I stopped the immediate problem? Do I have legal advice if needed? What is my key message? Media Inquiries: Don't speculate about cause or scope Focus on what you're doing to address it Groups and Allies You Work With: Alert them if they might be affected Share technical indicators (IPs, domains) if relevant Request additional resources if needed Law Enforcement Contact: Consult legal counsel first Prepare incident timeline and evidence Understand what you're asking for (investigation vs. advice) Evidence Preservation Checklist Digital Evidence Screenshots with timestamps of all relevant activity Full email headers saved, not just message content Browser history exported before clearing Account activity reports downloaded Social media posts archived with metadata Chain of Custody Documentation For each piece of evidence: What - Specific description of evidence When - Date and time collected (with time zone) Who - Name of person collecting Where - Location/account/device evidence came from Why - Relevance to the incident How - Method used to collect/preserve Chain - Who has handled it since collection Recovery and Lessons Learned Checklists Device and Account Recovery Malware removed from all affected devices Passwords changed on all potentially affected accounts Security software updated on all devices Post-Incident Review (Within 1 Week) Timeline documented - What happened when? Root cause identified - How did this happen? Lessons learned captured - What would I do differently? Prevention Improvements Insurance claims filed if applicable Quick Reference: When to Escalate Get Help Immediately Any threat of physical violence Suspected criminal activity (hacking, stalking, threats) Social security numbers or payment card data compromised Media already reporting on the incident Get Help Within 24 Hours Email account compromised Suspected state-sponsored or sophisticated attack Monitor and Handle Yourself Minor social media account compromise Suspicious but unsuccessful login attempts Emergency Contacts Template Keep this information readily accessible and secure: Support Contacts Legal Counsel: _________________ (Phone: ________, Available: ________) Technical Support: ______________ (Phone: ________, Signal: ________) Mental Health Support: __________ (Phone: ________, Crisis Line: _____) Groups/Allies: _____________ (Phone: ________, Signal: ________) Emergency Services Local Law Enforcement: _________________ (Phone: _________) FBI Field Office: _____________________ (Phone: _________) Crisis Counseling: ____________________ (Phone: _________) Key Account Recovery Information Email Provider: ______________ (Account: ________, Phone: ________) Social Media: _______________ (Account: _______, Recovery: ______) Remember: Print and store this securely. Review and update every 6 months.