Incident help
Whether it’s a suspicious email someone clicked, a locked-out account, or a ransom note, the first hour matters. These steps help, whoever you end up calling.
Email me directly
incident@missionassurancegroup.co
Weekdays 8am–6pm ET; I aim to reply within 2 business hours. Put “URGENT” in the subject line. If you have cyber insurance, call your insurer’s breach hotline first.
1
If you have a policy, call its claims or breach hotline before anything else. Many policies require you to use their approved responders.
2
Unplug affected computers from the network or turn off Wi-Fi, but leave them powered on. Shutting down can destroy evidence.
3
Use a device you trust to change passwords for affected accounts, starting with email, and turn on multi-factor authentication.
4
Note times, what people saw, and what was clicked. Take photos of any ransom notes. Don’t delete suspicious emails or files.
5
If there’s a ransom demand, don’t respond or pay before talking with your insurer and legal counsel.
6
Report cybercrime to the FBI at ic3.gov, and consider reporting to CISA. Personal data may trigger notification duties, so involve legal counsel early.
I help small organizations stay calm and make good decisions during an incident, and coordinate everyone involved.
I’m not a 24/7 forensics firm. For a major breach, you may need one, and your insurer will often assign it. I’ll help you get the right people involved quickly, and stay with you through the process.
The best time to plan for an incident is before one happens. A response plan and a tabletop exercise are part of every vCISO plan.
Learn about vCISO →