1️⃣ Get Ready Before Anything Happens

“Being ready is better than being lucky.”

✅ What to Do:

• Make a list of who to call if something looks suspicious (tech support, IT person, owner)

• Use strong passwords and turn on 2-step login (MFA) for everything

• Keep backups of important files—stored offline or in a secure cloud

• Install antivirus and keep updates turned on

• Practice a “What if something goes wrong?” drill every 6 months

2️⃣ Spot the Problem Quickly

“Don’t ignore the weird stuff—it could be a cyberattack.”

✅ Look for:

• Computers suddenly slowing down or crashing

• Pop-ups asking for money (ransomware)

• Login alerts from places you don’t recognize

• Emails you didn’t send or missing customer data

When in doubt, pause and report it to whoever manages your tech.

3️⃣ Stop the Damage

“Shut it down before it spreads.”

✅ What to Do:

• Unplug affected computers from the internet or Wi-Fi

• Stop using shared drives, cloud apps, or email until things are checked

• Don’t delete files—write down what you see (error messages, pop-ups, emails)

• Call your IT support or a cybersecurity service ASAP

4️⃣ Clean It Up

“Find out what happened and fix the holes.”

✅ What to Do:

• Let your tech support remove any viruses or threats

• Change all passwords, especially for email, banking, and cloud tools

• Delete suspicious accounts or software added without your permission

• Check with your IT provider to make sure the issue is truly gone

5️⃣ Get Back to Business Safely

“Restore what you need—carefully.”

✅ What to Do:

• Only use clean backups to restore lost files

• Keep a close eye on things for a few days

• Make sure all computers have security updates and antivirus running

• Notify customers if their data was involved (your IT or legal advisor can help)
  
  

6️⃣ Learn From It

“What did we learn? How can we do better next time?”

✅ What to Do:

• Write down:

  • What happened

  • What was done

  • What worked or didn’t
    
    

• Update your checklist or playbook

• Share lessons with the team (without blame)

• Schedule a refresher or training next quarter