The first response to an IT incident

Work through the steps.

1. 01

   Stop and contact the response owner

   Stop the affected activity. Use a known telephone number or another trusted channel to contact IT promptly. If your work account may be affected, use an alternative agreed channel.

   Explain the symptoms, when they started and whether you clicked, entered details or approved a prompt. Describe observations rather than guessing the cause; early reporting helps the responder decide what to do.

2. 02

   Contain only within the agreed plan

   For a suspected infected device, follow your incident plan or IT instructions about disconnecting its network connection. Do not disconnect shared infrastructure, safety systems or other people's equipment yourself.

   Avoid restarting, wiping or running cleanup tools while awaiting instructions because evidence may be lost. If you cannot isolate an actively affected device, seek urgent IT direction on the safest next step.

3. 03

   Keep a clear incident record

   Record times, the device name, error messages and actions already taken. Preserve originals as IT directs. Do not forward suspicious files broadly or post confidential screenshots into a group chat.

   Agree who coordinates business updates and recovery decisions. Refer potential data exposure, insurer requirements and notification decisions to the authorised business lead and appropriate advisers.