Printable cards

Seven cards for the worst hour.

Print them once. Put them where a frightened person can reach them without unlocking anything. Each card is one page, and each one runs STOP, RECORD, CONTAIN, CALL, RECOVER.

Or answer questions with Sentry

Before you print

Fill in the two phone numbers you would actually call, on paper, before you need them. During an incident you must never use a number that arrived in the message causing the incident.

Higher Ground — incident cards. Defensive use only. Not legal advice. If anyone is in danger, call 911 first. Physical safety overrides evidence preservation, always.

Card 1 of 7 · Any incident · STOP / RECORD / CONTAIN / CALL / RECOVER

First 15 minutes

Stop

Check physical safety. If anyone or any critical equipment may be in danger, call emergency services and follow their instructions.
Do not pay, do not message whoever is asking, do not publish who you think did it, do not mass-delete, do not wipe, do not hack back.

Record

Write the exact symptom. Do not interpret it yet.
Include device, account or app, address, exact wording, time first seen, and last known good.
Photograph or screenshot the minimum needed. Note where the original is stored.

Contain

For an ordinary computer with credible active harm, disconnect the network if it is safe. Prefer leaving it powered on for a responder.
If isolation is impossible and destructive activity continues, or there is a physical hazard, power off following the safety procedure.
For operational, medical, vehicle or building systems, do not disconnect until the authorised operator confirms the safe sequence.

Call

Call the known-good contact written on this card. Never a number from the message, pop-up or call that started this.

Recover

Start the decision log: who decided, what changed, why, the time, the expected effect, and how to roll it back.

Fill this in as you go

Incident ownerTime opened (UTC) / local timeExact symptomWho and what is affectedActive harm right nowFirst safe next action

Card 2 of 7 · Files encrypting or deleting · contain before you understand

Ransomware or destructive activity

Stop

Stop the spread. Isolate affected machines and accounts using controls you already approved.
Do not connect offline backup media to a suspected system.
Do not start mass restores before the way in is contained.
Do not pay and do not negotiate without professional and law-enforcement advice.

Record

Capture the ransom note, the file names and extensions, the affected shares, the first host and account seen, alert identifiers, and the times.

Contain

Protect the backups: restrict backup administration, stop unauthorised deletion or replication changes, and preserve retention settings.
Record every containment action as you take it.

Call

Incident lead. Cyber insurer or breach counsel. Critical vendors. Law enforcement and your reporting contacts, per policy.

Recover

Rebuild from trusted media and verified configuration, into a clean, segmented environment.
Validate identity, network, endpoint and backup control planes before reconnecting production.
Keep recovery evidence: source, hash, restore time, test result, approver, business acceptance.

Fill this in as you go

Systems isolatedBackup protection action takenKnown-good recovery sourceNext command update (UTC)

Card 3 of 7 · Someone else is in an account · order matters

Account takeover

Stop

Work from a device you trust, not the one you suspect.
Do not use links from the alert message. Use your own bookmark or type the address.

Record

Screenshot the sign-in and security activity page before changing anything.
Note times, locations shown, and anything sent that you did not send.

Contain

Change the password to something long and unique.
Sign out of all other sessions and devices.
Turn on multi-factor authentication, preferably a passkey or an app rather than text-message codes.
Check the recovery email and phone number, mail forwarding rules, filters, and connected apps.

Call

Bank, if the account holds payment details or receives codes. Employer, if it is a work account. Contacts, so they distrust messages sent today.

Recover

Change the same password anywhere else it was used.
Watch sign-in alerts for a fortnight.

Fill this in as you go

AccountLast known good sign-inSessions revoked at (UTC)Other accounts sharing that password

Card 4 of 7 · Integrity anomaly · an anomaly is not proof

An app changed on you

Stop

Do not enter a password or code into it until you have checked.
Do not clear the profile, reinstall, or redeploy over the top yet.

Record

Record the exact name, icon, text, address, signed-in account and tenant, device and browser, time in UTC, first seen, and last known good.

Contain

Compare the canonical bookmark on a trusted device or a separate clean profile.
Check browser translation, accessibility settings, extensions, saved web apps, expected localisation and the service status page.
Check authorised release and change tickets and recent owner or administrator changes on official account pages.
Match the chain: domain, address record, hosting project or alias, deployment, build, commit, runtime data source, actor. Record missing links as unknown.
If two independent records support unauthorised change, contain only the affected session, integration, token, deploy hook, alias or credential.

Call

Platform provider with your log entries. Identity provider for sign-in records. Law enforcement if evidence supports unauthorised access.

Recover

Preserve before and after evidence. Make one controlled change. Verify the visible name again yourself.

Fill this in as you go

Canonical app identifier or addressObserved nameExpected nameAccount / tenant / environmentEvidence identifiersClassification and approver

Card 5 of 7 · No connected device required

Outage and offline continuity

Stop

Do not connect unknown drives. Do not accept remote-support software from an unsolicited caller.
Do not share unverified claims about the cause.

Record

Note what stopped, when, and what you could not do. Record every manual transaction for later reconciliation.

Contain

Confirm whether it is power, local network, provider, identity, address resolution, cloud platform, application or one device.
Move critical work to the documented manual process.
Use the sealed offline copy of configuration and recovery instructions. Keep recovery codes somewhere else.

Call

Use the printed call tree and known-good numbers. Do not trust contact details delivered during the incident.
If radio or navigation interference is suspected, follow official reporting and alternate-navigation procedures. Never transmit interference.

Recover

When service returns, reconcile the offline records, validate integrity, rotate only exposed credentials, and document the decision.

Fill this in as you go

Service unavailableManual workaround activatedTransactions to reconcileReturn-to-service approver

Card 6 of 7 · Your phone is a keyring · change what it opens

Lost or stolen device

Stop

If it was taken by a person, do not go to the location on the map. Give it to the police.
Do not respond to demands for a passcode or account unlock in exchange for the device.

Record

Note the time and place, the number, and the serial or IMEI if recorded. Screenshot the last known location.

Contain

Mark the device as lost, which locks it and shows a message.
Call the carrier, suspend the number, and set an account PIN.
Change email first, then bank, then anything else that sends codes to that device.
Move multi-factor codes to a new device using your recovery codes.

Call

Police, with the location and serial number. Carrier. Bank, if payment apps were installed.

Recover

Erase remotely once the location is no longer needed. Restore to a new device from backup, then review which apps were signed in.

Fill this in as you go

Device and serial / IMEINumber suspended at (UTC)Accounts securedPolice report reference

Card 7 of 7 · They told you · that is the hardest part done

Child safety event

Stop

Say clearly that they are not in trouble for telling you.
Do not pay. Do not delete the messages or the account. Do not let the child respond further.
If anyone is in immediate danger, call 911 first.

Record

Screenshot the profile, messages, usernames and platform. Note times and dates. Keep it all in one place.

Contain

Block the account after capturing evidence. Make their accounts private. Review who can message them. Change passwords together.

Call

Law enforcement. In the United States, the FBI at ic3.gov and the NCMEC CyberTipline at report.cybertip.org.
The platform, using its reporting tools for threats and image removal.
The school counsellor or your doctor. This is a safeguarding matter and there are people whose whole job it is.

Recover

Stay close over the days that follow. The shame is the weapon, and it carries a real risk of self-harm.
Get support for yourself as well.

Fill this in as you go

Platform and account involvedEvidence captured at (UTC)Reported toPerson supporting the child

Keep two copies

One working copy you write on, and one sealed copy stored offline. Review both once a quarter and destroy superseded copies so nobody works from an old call tree.

Seven cards for the worst hour.

How to use these cards

Before you print

First 15 minutes

Fill this in as you go

Ransomware or destructive activity

Fill this in as you go

Account takeover

Fill this in as you go

An app changed on you

Fill this in as you go

Outage and offline continuity

Fill this in as you go

Lost or stolen device

Fill this in as you go

Child safety event

Fill this in as you go

Keep two copies