PRACTICAL WORKBOOK
Suspected infection: isolate first, then preserve evidence
Have the incident lead coordinate the next steps to prevent further spread.
01 / Define the scope
02 / Check and Record Evidence
Confirm the scope first, then expand each item to check it. For 'Completed', enter an owner and evidence; for 'Not applicable', enter a reason. Progress reflects record status only, not a security score.
Data is processed only on this page and is not uploaded or saved automatically. Before leaving, download the HTML and confirm it has been saved; open that file later to continue. Do not enter passwords, verification codes or complete sensitive configurations.
Expand one item to focus on it, or view all items at once. Printing includes every item.
If an attack is suspected, disconnect affected devices from networks and external storage
PendingMore information needed
Check your environment against this guide and official documentation. Record actual findings and differences that need follow-up.
Suggested evidence: configuration or change record number, test date, results and reviewer.
Preserve alerts and related evidence for the IT lead to follow up
PendingMore information needed
Check your environment against this guide and official documentation. Record actual findings and differences that need follow-up.
Suggested evidence: configuration or change record number, test date, results and reviewer.
Check trusted recovery resources in a clean environment; do not run unfamiliar tools indiscriminately
PendingMore information needed
Check your environment against this guide and official documentation. Record actual findings and differences that need follow-up.
Suggested evidence: configuration or change record number, test date, results and reviewer.