Phishing and business email compromise: incident response playbook

First 15 minutes

1. Reset the user's password and sign out all their sessions.
2. Check the mailbox for new forwarding rules and remove them.
3. Block the sender and the link at the email gateway.
4. Search for the same email in other mailboxes and remove it.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (3 steps)
• Eradicate (2)
• Recover (2)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 8 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Ransomware
• Lost or stolen device
• Data sent to the wrong person or exposed
• Compromised account or cloud admin access
• Malware on a device
• Major outage or denial of service
• Supplier or third-party breach
• AI tool data leak or misuse