Whether it's a ransomware message on a screen, a server that's suddenly gone silent, or an entire office that's lost its internet connection, the first few minutes of an IT emergency tend to be chaotic. Having a basic, calm checklist ready — before you need it — makes a genuine difference to how the rest of the incident goes.
1. Don't panic-click
The instinct when something looks badly wrong is to start clicking things, restarting machines, or trying fixes at random. For most problems this is harmless, but for a small number of serious ones — particularly anything that looks like ransomware or a security breach — acting too fast can destroy evidence or make the problem worse. If something looks like an attack rather than an ordinary fault, stop and think before doing anything else.
2. If it might be a cyber incident, isolate first
If you suspect a device has been compromised — a ransomware message, unexpected pop-ups demanding payment, or software behaving in ways nobody recognises — disconnect that device from the network immediately (unplug the network cable, or turn off Wi-Fi) rather than shutting it down. This limits anything from spreading to other devices while preserving the state of the machine for whoever investigates it.
3. Work out how widespread it is
Is it one machine, one department, or the whole building? Is it affecting everyone, or just people on a particular system? A quick, calm check — asking a couple of colleagues "can you get online / can you access X" — gives whoever you call next a much clearer picture to start from, and saves time that would otherwise be spent diagnosing the obvious.
4. Call your IT support straight away, not last
This sounds obvious, but it's common for businesses to spend twenty or thirty minutes trying things themselves before calling for help — time that's often better spent letting someone who does this daily get started. If you have a genuine emergency, call rather than emailing or logging a routine ticket; most support arrangements have a clear distinction between "normal request" and "urgent," and it's there to be used.
5. Tell the people who need to know
Depending on what's affected, that might mean warning staff not to use a particular system, letting customers know about a delay before they have to ask, or — if personal data may be involved — starting to think about whether you have any regulatory obligations to consider. None of this needs to be perfectly handled in the first ten minutes, but starting the conversation early beats explaining a long silence later.
6. Start a simple timeline, even roughly
Jot down, even just in a notes app, roughly what happened and when you first noticed it. This feels unnecessary in the moment, but it's genuinely useful afterwards — both for whoever's fixing the problem and, if it turns out to be a security incident, for any investigation or report that follows.
The point of having this ready in advance
None of this is complicated, but it's much easier to follow a calm checklist you've seen before than to invent a sensible response from scratch while something is actively going wrong. It's worth a few minutes now, so the next genuinely bad day goes as smoothly as it can.
If you'd like a clearer sense of what your own emergency process should look like, including who to call and when, get in touch and we'll help you put one together.
Talk to a local IT team
Get in touch and we'll talk you through how we can help — no pressure, no jargon.