Compromised account or cloud admin access: incident response playbook

First 15 minutes

1. Disable the account or remove its admin rights.
2. Revoke sessions, tokens and API keys it owns.
3. Check for other accounts created or changed in the same period.
4. Escalate to SEV2 or SEV1 if it had admin rights.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (2 steps)
• Eradicate (1)
• Recover (1)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 8 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Phishing and business email compromise
• Ransomware
• Lost or stolen device
• Data sent to the wrong person or exposed
• Malware on a device
• Major outage or denial of service
• Supplier or third-party breach
• AI tool data leak or misuse