Home / Commons / Step by step / Our organization was hacked

Commons · Step by step

Our organization was hacked.

For a small organization after a phishing click, a taken-over account or another security incident. The pages on moraph.org that cover it, in 5 steps.

  1. Step 1After a phishing click: the next 24 hours

    What to do in the first hour, the same day and the next 24 hours, who to tell, and how to review it afterwards.

  2. Step 2Write it down as it happens

    A timestamped log for the day something goes wrong, with account-recovery checklists from official sources and the agency to report to.

  3. Step 3After an incident: a short, blameless review

    When the emergency is over, an hour with the right people turns what happened into three to five fixes, each with an owner and a date.

  4. Step 4Your first hour, on one page

    Answer a few questions and get a one-page incident plan to print and keep away from your network: who decides, who to call, what to disconnect, where the backups are.

    And

  5. Step 5Run your own incident exercise, around a table

    A guided conversation about an incident that is not happening, so the real one is less of a surprise.

    And

Each step opens a page that is already on moraph.org. You can start at any step and skip the ones that don’t apply. Every page in the list says which step it is, with links to the step before and after.

Something wrong or out of date on this page? Report a problem with this page (opens your mail app, to hello@moraph.org)