Resources / Checklists / Phishing incident response
Phishing incident response checklist
What to do in the first hour, the first day and the weeks after someone clicks. A practical, printable checklist built around the NCSC’s four layers of phishing defence, with specific steps for credential theft and adversary-in-the-middle (AiTM) attacks on Microsoft 365.
4NCSC layers of defence covered
1 hourquick-reference response card
7stages from preparation to lessons learned
What’s inside
- A readiness review mapped to the NCSC’s four layers: stop phishing reaching users, help users report it, limit the damage when it works, and respond quickly
- A first-hour card to print and keep with your incident contacts
- Step-by-step response: triage, containment, investigation and recovery
- Reporting duties, including the ICO’s 72-hour rule for personal data breaches, Report Fraud and the NCSC’s Suspicious Email Reporting Service
Why a password reset isn’t enough
In an adversary-in-the-middle attack, the phishing page captures the password and the one-time MFA code, then steals the signed-in session. Containing it means revoking sessions and checking MFA methods as well as resetting the password. The checklist walks through each step.
Who it’s for
- IT leads, service desks and managed service providers
- Data protection and finance leads
- Directors who make decisions during an incident
Download the full checklist
Readiness checks, a first-hour response card, containment, investigation, recovery and reporting. PDF, 7 pages, 0.4 MB. No form required.