A strange sign-in alert, encrypted files or a missing laptop can trigger a rush of messages and well-meant fixes. The first priority is to limit further harm while preserving enough information for the people who need to assess the incident.
1. Report and contain safely
Tell staff exactly how to contact the internal incident lead or IT support. If a device appears compromised, disconnect it from Wi-Fi or network access where safe, but do not wipe it or reinstall software before receiving guidance. For a lost device, report the loss promptly so company access can be revoked.
Do not approve unexpected MFA prompts, continue a suspicious conversation or forward a harmful attachment to colleagues. If a payment instruction or bank detail changed, pause the transaction and verify through a known, separate channel.
2. Preserve useful details
Record what was observed, when it began, the device or account involved and any actions already taken. Keep relevant emails, alert screenshots and ticket references. Avoid posting sensitive incident details in broad chat channels.
Do not guess the cause or promise that data is safe. A designated technical responder should determine whether other accounts or devices may be affected and what evidence should be retained.
3. Make the right decisions quickly
Identify who can disable accounts, isolate systems, contact insurers or external specialists, and approve customer or regulator communications when required. The right escalation depends on the data, service and contractual obligations involved. Keep a decision log with time and owner.
For suspected fraud, contact the bank through its official number. For a security event, use verified contact details for your IT provider. If systems are unavailable, switch to a documented manual process for essential operations.
Prepare before the alert arrives
Keep emergency contacts accessible outside the systems that could fail. Rehearse a short scenario with management and staff: who reports, who decides, how the team communicates and how critical work continues.
A managed IT provider can support containment and technical recovery, but the business should own its incident priorities and communication decisions. A clear plan turns a frightening first hour into a sequence of manageable actions.
Want to understand whether your current IT support fits your business? Explore Managed IT Services.