Information that helps an assessment
- What you noticed and when it began
- Any recent downloads or unexpected prompts
- Devices and users affected
- Backup status and business impact
Record symptoms without spreading the problem
Note the time an alert appeared, its wording and what you were doing immediately beforehand. Distinguish a browser pop-up from a notification produced by an installed security application. Mention whether other people or devices are affected and whether any business service has stopped working.
Do not follow an unexpected prompt to pay, install remote access software or disclose account details. Use your established support channel to arrange an assessment. If the device belongs to a business, coordinate with the person responsible for security and preserve relevant observations for that review.
Before we get started
For a suspected business security incident, follow your established incident procedure and contact your designated support provider. Keep passwords and confidential records out of general inquiries.