Incident Reporting and Ransomware Readiness
Give every employee a clear playbook for the first minutes after a suspected cyber or privacy incident — suspicious emails, lost devices, misdirected messages, exposed files, account compromise, ransomware, or vendor compromise. Learn what to preserve, what to stop, what to document, and who to call — without making the situation worse.
What you'll learn
- Recognize what counts as a reportable incident — not just an obvious breach, but suspicious emails you clicked, lost devices, accidentally shared files, and account behavior you didn't initiate.
- Take safe, non-destructive immediate actions: isolate what you can, stop what's spreading, and avoid steps that would destroy evidence or alert the attacker.
- Preserve useful evidence: the time, the message, the sender, the URL, the device state — without deleting, forwarding to everyone, or trying to 'fix' the problem yourself.
- Follow your organization's established escalation path — the right contact at the right time — rather than guessing, hiding the problem, or waiting until 'someone else' notices.
- Communicate facts without speculation when reporting: what happened, when, what you did, and what you observed — not what you think the attacker was doing or who is to blame.
- Understand ransomware specifically — what the early signs look like, why pulling the network cable buys the organization critical hours, why paying almost never works, and why restoring from backups does not undo data theft.
Requirements
- A workstation, laptop, tablet, or phone with a modern browser.
- Audio or captions enabled so you can follow the narrated video for each module.
- No prior cybersecurity knowledge required — this course is designed for every employee, including managers, IT support, and operations staff who may be the first to receive an incident report.
Course content
7 chapters · 6 lectures · 25m total
Module 1 — Why Speed Matters
The clock starts the moment an incident begins — not when IT finds out. Why minutes-to-hours is the realistic window for most damage, how embarrassment delays amplify every consequence, and why 'when in doubt, report' is the single most valuable habit in this course.
1 item
Module 1 — Why Speed Matters
The clock starts the moment an incident begins — not when IT finds out. Why minutes-to-hours is the realistic window for most damage, how embarrassment delays amplify every consequence, and why 'when in doubt, report' is the single most valuable habit in this course.
-
Why Speed Matters Free preview4 minutes
Module 2 — What Is an Incident
Most incidents don't look dramatic — they look like a suspicious email, a missing laptop, a share link that reached the wrong group, or an MFA push you didn't initiate. The broad working definition of a reportable incident, with three categories employees miss most often.
1 item
Module 2 — What Is an Incident
Most incidents don't look dramatic — they look like a suspicious email, a missing laptop, a share link that reached the wrong group, or an MFA push you didn't initiate. The broad working definition of a reportable incident, with three categories employees miss most often.
-
What Is an Incident4 minutes
Module 3 — First Actions for Email and Account Compromise
You just typed your password into a page that now looks wrong, or you tapped 'approve' on an MFA push you didn't initiate. The specific, non-destructive actions to take in the next five minutes — from a known-good device, through the real sign-in page, with the help desk already on the line.
1 item
Module 3 — First Actions for Email and Account Compromise
You just typed your password into a page that now looks wrong, or you tapped 'approve' on an MFA push you didn't initiate. The specific, non-destructive actions to take in the next five minutes — from a known-good device, through the real sign-in page, with the help desk already on the line.
-
First Actions for Email and Account Compromise4 minutes 30 seconds
Module 4 — Lost Devices and Accidental Disclosure
A smashed-car-window laptop, a tablet left on the bus, a misdirected spreadsheet, a share link set to 'anyone with the link' by mistake, and the found USB drive in the conference room. Why these are reportable the same hour you notice them, and how to stop the bleeding without destroying evidence.
1 item
Module 4 — Lost Devices and Accidental Disclosure
A smashed-car-window laptop, a tablet left on the bus, a misdirected spreadsheet, a share link set to 'anyone with the link' by mistake, and the found USB drive in the conference room. Why these are reportable the same hour you notice them, and how to stop the bleeding without destroying evidence.
-
Lost Devices and Accidental Disclosure4 minutes
Module 5 — Ransomware and Vendor Incidents
The early signs of ransomware on a workstation or shared drive, the one action that buys the organization hours (pull the network, leave it running), why paying almost never works, and why 'restored from backup' does not undo the data theft that modern ransomware groups do first. Plus: what to do when a vendor says they were breached.
1 item
Module 5 — Ransomware and Vendor Incidents
The early signs of ransomware on a workstation or shared drive, the one action that buys the organization hours (pull the network, leave it running), why paying almost never works, and why 'restored from backup' does not undo the data theft that modern ransomware groups do first. Plus: what to do when a vendor says they were breached.
-
Ransomware and Vendor Incidents4 minutes 30 seconds
Module 6 — What to Document and Who to Call
The mechanics of a good incident report: four questions to answer cleanly (what, when, what you did, what you observed), what to preserve without destroying evidence, why to skip speculation, and the exact escalation path to the help desk, security, your supervisor, and the privacy officer.
1 item
Module 6 — What to Document and Who to Call
The mechanics of a good incident report: four questions to answer cleanly (what, when, what you did, what you observed), what to preserve without destroying evidence, why to skip speculation, and the exact escalation path to the help desk, security, your supervisor, and the privacy officer.
-
What to Document and Who to Call4 minutes
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
1 item
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
-
Final Assessment — Incident Reporting and Ransomware Readiness