1. Systems
  2. Incident
  3. Urgency
  4. Your details
  5. Review

Step 1 of 5 — Systems

What is affected?

For example: Windows file server, SQL Server, Microsoft 365.

Step 2 of 5 — Incident

What happened?

When did it start? Is there a ransom note? Has anything been changed since?

Step 3 of 5 — Urgency

How urgent is it?

Step 4 of 5 — Your details

International format if possible, e.g. +966…

How should we contact you?

Step 5 of 5 — Review

Check your answers above, then send the report.