6.4Toolbox
The essentials in 30 seconds
- Before acting: sender, hovered URL and expected attachment are verified — when in doubt, do not click, report.
- In case of incident: isolate without switching off, alert IT, note time and symptoms, restore offline.
- Rule: a printed sheet near the workstation beats a method known by heart — under stress, you execute.
Karim thread — the sheets at hand
After one year, both sheets below are displayed at Karim's desk: the before-you-click one next to the screen, the incident one in his drawer with the IT contact. “What saved me, he says in substance, is not knowing the points, it is ticking them every time — especially in rush weeks.”
Adapt the wording to your context, keep the structure: it is what avoids omissions and panic.
Ready-to-use reference points
A good checklist makes a reaction fast and complete; good reflex sheets prevent panic. Adapt to your context.
Before clicking / acting
- Is the sender (full domain) the right one?
- Does the hovered URL lead to the official site?
- Is there urgency, fear or imposed secrecy?
- Am I being asked for credentials, a payment or a code?
- Have I verified through another channel?
- Was this attachment expected?
- Should I log in via my bookmarks instead?
- When in doubt: I do not click, I report.
Incident reflex sheet
- Isolate: disconnect the network, do not switch off
- Alert: IT / contact person (name + number)
- Stop touching the workstation; note time and symptoms
- Hacked account: password from a healthy device + two-factor authentication
- Never pay any ransom
- Restore from the offline backup
- Report: internally, then through the official channels indicated by IT
- File a complaint in case of fraud or hacking
Ready-to-say script — reporting a doubt to IT (30 s)
“I received [e-mail / call / attachment] at [time] asking me for [credentials / payment / code]. I have not clicked. The sender is [domain] and the hovered URL leads to [address]. I am forwarding it to you and I remain available.”
Copy-paste template — doubt + incident tracking (1 line per point)
DOUBT on ... at ...: sender (full domain) checked: OK / to redo
Hovered URL compared with the official site: OK / to redo
PRESSURE (urgency, fear, secrecy) spotted: OK / to redo
ATTACHMENT expected or not: OK / to redo
LOGIN via bookmarks rather than link: OK / to redo
REPORT to IT on ... at ...: OK / to redo
INCIDENT: network disconnected WITHOUT switching off + time noted: OK / to redo
OFFLINE restore + complaint if needed: OK / to redoSmall business / tight budget
Sheets on one page posted on the wall: the essentials (domain, URL, separate channel, IT contact) are enough.
Algeria SME
Plan local realities into the sheet: known IT contacts, peaks, travel, usual phone channels.
Remote / hybrid
Add a written-confirmation line to the tracking: at a distance, a dated written report avoids misunderstandings.
Cross-cultural
Spell out headings in writing: what seems obvious (who to alert, which channel) is not obvious to everyone.
48h challenge — apply tomorrow
Take 1 recent doubt, run the “before clicking” checklist and tick where it stands. Write the IT contact on the incident sheet.
- I have ticked a checklist on a real doubt.
- I know how to pull out the before-you-click and the incident sheet at the right moment.
- I have done the 48h challenge or scheduled its date.
Karim hesitates in front of an unexpected attachment pressing him to act. What should he tick first?
Tip: print the incident reflex sheet and keep it near the workstation — under stress, you execute, you no longer think.