The first hour after something looks wrong
Someone clicked something, or an invoice went to the wrong bank account, or a staff member cannot get into their email and you did not lock them out. You do not yet know what has happened. That is normal, and the first hour still matters.
The instinct to delete the evidence and say nothing is the instinct to resist.
Do this today
- Write the plan down now, while nothing is wrong. One page: who gets called first, who can lock an account, who talks to the bank, who talks to customers.
- Know how to reset a password, revoke active sessions and disable an account in your email platform — and make sure two people know, not one.
- Keep the evidence. Do not delete the message or wipe the machine. It is how anyone helping you works out the scope.
What good looks like
The plan is one page, printed, and does not live only in the email system that might be the thing affected.
Reporting something is treated as good judgement. If staff fear blame, you find out about incidents last.
Want someone to just do this for you? Start a conversation — twenty minutes, free.
Last reviewed: September 2026