Process template: handling a safety incident
From suspicion to learning, step by step
§Discover and assess
- 01Note what raised suspicion and when
- 02Assess how serious it is and what may be affected
- 03Inform the right people according to the company's plan.
- 04Avoid deleting traces—they can be important afterward.
§Limit the damage
- 01Isolate affected systems from the rest of the network
- 02Block suspicious accounts and change relevant access codes
- 03Stop spreading before you start cleaning up
§Clean up and restore
- 01Remove the harmful and close the hole that was exploited
- 02Restore data from a known, clean backup
- 03Confirm that the systems work before they are put back into use
§Lær af det
- 01Document progress, cause and what helped
- 02Find out how a similar fracture can be prevented
- 03Adjust routines, training or setup based on experience