Free practice · ordering · medium

Practice

Order a safe beginner incident handoff

Arrange the immediate response after a worker notices suspicious account or device behavior.

Beginner incident handoff

Stop harm, preserve facts, and support authorized recovery

  1. StopEnd the risky action
  2. ContainUse only authorized instructions
  3. ReportShare assets, time, facts, and actions
  4. PreserveKeep evidence and a factual timeline
  5. CoordinateSupport scope and business decisions
  6. RecoverVerify clean service and improve controls

A strong beginner response is prompt and factual without becoming an unauthorized investigation, cleanup, payment, or public-communication effort.

Arrange in the correct order
  1. 1. Follow the incident lead's account, device, and recovery instructions
  2. 2. Preserve messages, files, alerts, and other available evidence
  3. 3. Report the affected account or asset, time, symptoms, and actions
  4. 4. Use only the containment action authorized for your role
  5. 5. Stop the suspicious activity without exploring further