Printable checklist
First hour after a phishing click
Keep this by your desk or in your incident notes. Work top to bottom.
Do these in order
- One-sentence incident note (who / what / device / when)
- Device off the network
- Sessions revoked for the affected cloud account
- Password reset + MFA on; rotate reuse and shared secrets via vault
- Mailbox rules, forwarding, and OAuth apps checked
- Bank / payments checked if relevant; call on a known number
- Internal payment freeze message sent
- Evidence noted; device rebuild or scan booked
- One-week harden list started
Free to print and share. If you share it online, please link to this page. From OwnerSec (ownersec.co.uk). Not NCSC, legal or insurance advice.
From the guide: First hour after a phishing click. Checked 10 November 2026.