iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start by treating the event as a suspected intrusion, not a proven act of state sponsorship. Your checklist should trigger coordinated incident handling, assign one incident lead, preserve evidence before it is changed, establish the affected scope, contain the threat without creating avoidable operational harm, meet reporting obligations, and document every material decision. Keep three labels separate throughout: suspected, verified, and attributed.
The checklist below is a living response document. It is based on the sequence in the CISA Federal Government Cybersecurity Incident and Vulnerability Response Playbooks, but that playbook is written for federal civilian executive agencies. Adapt its roles, deadlines, escalation paths, and reporting channels to your organization, sector, jurisdiction, contracts, and operating environment.
What this checklist must accomplish
A suspected nation-state intrusion is both a technical investigation and a business-continuity event. The checklist must help responders answer, in order:
- What was reported, by whom, when, and with what initial observations?
- Which systems, identities, facilities, suppliers, and data may be involved?
- Is the activity still active, and can it spread or retain access?
- What evidence must be preserved before isolation, patching, rebuilding, or password changes alter it?
- What containment action reduces risk without creating an unsafe or unacceptable service outage?
- Which legal, regulatory, contractual, sector, government, or law-enforcement notifications apply?
- What facts are verified, what remains a hypothesis, and who owns each next decision?
Use a central record with an owner, timestamp, status, and source for every significant entry. A finding should never silently change from an assumption into a fact. Mark each item as confirmed, probable, possible, or unknown, and retain the underlying evidence reference.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Set up ownership before an incident
A checklist fails when everyone can add tasks but nobody can authorize a disruptive action. Put these roles and decision rights in the document before an alert occurs:
- Incident coordination lead: runs the response, sets meeting cadence, assigns owners, and keeps the master timeline.
- Technical lead: directs detection, containment, forensic collection, eradication, and validation.
- System and identity owners: explain normal operation and approve changes affecting their services or accounts.
- Legal and privacy counsel: assess preservation, privilege, notification, contractual, and law-enforcement issues.
- Communications lead: controls internal messages, customer or partner notices, and any public statement.
- Business-continuity and operations leads: decide how critical functions continue during isolation or loss of access.
- Executive decision maker: resolves conflicts between risk reduction, safety, revenue, and service availability.
List alternates, phone numbers, secure communications methods, and the authority required for each action. Include a rule that responders use an out-of-band channel if corporate email, identity systems, or collaboration tools may be compromised.
Phase 1: Trigger and coordinate
Capture the initial report
Open an incident record as soon as suspicious activity is reported. Record the reporter’s name and contact method, the report time and time zone, affected users or systems, detection source, observed indicators, and what has already been done. Preserve the original alert, message, attachment, or ticket rather than relying on a rewritten summary.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Declare and classify the incident
The coordination lead should decide whether the event meets the organization’s incident-declaration threshold and record the reason. Do not write “state-sponsored breach” as an established fact. Use a working label such as “suspected state-sponsored intrusion” and retain separate fields for verification and attribution confidence.
Make the first notifications
Notify leadership, security and IT responders, affected system owners, legal counsel, communications, and business-continuity personnel under the approved plan. Limit distribution to people who need the information, but do not delay a necessary safety or containment decision while waiting for a perfect contact list.
Start the decision timeline
For every consequential action, record the time, person, action, reason, evidence considered, expected effect, and rollback or follow-up. Include decisions not to isolate, not to shut down, or not to notify yet. This prevents hindsight from obscuring why an action was reasonable at the time.
Phase 2: Contain while protecting evidence and operations
Rapid containment can stop further access, but an indiscriminate shutdown can destroy volatile evidence or interrupt critical services. Require an accountable decision for each affected asset.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
| Situation | Checklist decision | Record |
|---|---|---|
| Active compromise with a clear risk of spread | Consider immediate isolation of the host, account, segment, or service, using the least disruptive control that stops the observed path. | Who authorized it, exact control used, time applied, expected impact, and reversal method. |
| Evidence may disappear when a system is changed | Coordinate collection of volatile data, memory, logs, or images before patching, rebooting, rebuilding, or deleting artifacts when practical. | What was collected first and why delay or immediate isolation was chosen. |
| Critical business or safety function | Consult operations and the continuity plan before isolation; use a safe operating mode or compensating control where available. | Service and safety impact, approved exception, and next review time. |
| Backups or recovery infrastructure may be reachable | Secure and inspect backup systems as part of the incident scope; protect copies from the suspected actor. | Backup locations checked, access controls changed, and restoration trust decision. |
CISA state-sponsored-threat guidance recommends isolating affected systems, securing backups, and reviewing relevant logs and artifacts. That is urgent guidance, not a universal technical command for every network. The person approving isolation must weigh the affected system, available evidence, blast radius, and operational consequences.
Handle operational technology and safety-sensitive environments
If the incident touches industrial control, building systems, medical equipment, transportation, or another safety-sensitive environment, place operations and safety authority beside the technical lead in the decision path. The continuity plan should state how the organization will operate if it loses access to or control of IT or OT systems. A technically correct isolation that creates an unsafe physical condition is not a successful containment action.
Use reversible controls where feasible
Prefer controls that can be removed after validation: narrowly scoped network blocks, temporary account suspension, segmentation, access-token revocation, or monitored isolation. Permanent deletion, broad reimaging, and emergency configuration changes may be necessary, but document the exception and the evidence that supports it.
Phase 3: Preserve evidence and chain of custody
Collect the right sources
Start with sources that can answer who accessed what, from where, and when. The CISA federal checklist names audit, transaction, intrusion, connection, system-performance, and user-activity logs. Depending on your environment, add endpoint telemetry, identity-provider records, authentication events, firewall and proxy logs, DNS data, cloud control-plane records, remote-access logs, email security data, and relevant application logs.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When necessary and possible, preserve memory and forensic disk images. Coordinate with legal counsel and qualified forensic personnel before collection if the work may become evidence in litigation, regulatory action, or a criminal investigation.
Record acquisition details
For every item, record the source system and unique identifier, collector, collection time and time zone, acquisition method and tool version if relevant, hash or integrity value when used by your procedure, storage location, transfer history, and every person who accessed it. Preserve an original copy under the organization’s evidence-handling rules and analyze a working copy.
CISA’s checklist states: “Collect and preserve data for incident verification, categorization, prioritization, mitigation, reporting, attribution, and as potential evidence in accordance with NIST 800-61r2.” Its playbook also directs responders to log how, when, and by whom evidence was acquired. See the official playbook PDF for the source wording and federal checklist context.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Protect collection from the incident
- Use a clean, access-controlled repository separate from systems suspected of compromise.
- Restrict write access and log every copy, transfer, and analysis step.
- Synchronize timestamps or document clock differences among systems.
- Do not email unredacted logs, credentials, memory captures, or personal data through a potentially compromised account.
- Document gaps, such as a disabled sensor, overwritten retention window, or unavailable cloud record.
Phase 4: Determine scope and investigate persistence
Scope is not just a list of infected computers. It includes initial access, accounts, privilege, lateral movement, data exposure or change, operational impact, persistence, connected infrastructure, and third parties.
Answer the scope questions
- What was the earliest reliable sign, and what is the last confirmed activity?
- Which hosts, identities, applications, cloud tenants, network segments, and facilities are involved?
- What privileges did the actor obtain, and were administrative or domain-level credentials used?
- Did the actor move laterally, create accounts, alter authentication settings, or establish scheduled or startup persistence?
- What data was viewed, copied, modified, encrypted, or deleted?
- Could the actor reach identity infrastructure, backup systems, management planes, or connected suppliers?
- Which services, customers, employees, or safety functions experienced an effect?
Correlate across control planes
Compare endpoint, identity, network, firewall, proxy, cloud, remote-access, and application records. Look for a coherent sequence rather than treating a single alert as the whole incident. Compare suspicious activity with known authorized administration, maintenance windows, service accounts, and expected travel or automation so that ordinary work is not mislabeled as intrusion.
Use advisories as hunting hypotheses
When activity resembles indicators or techniques in a current CISA advisory, use that advisory to expand searches and identify connected systems. In one CISA advisory concerning Iranian government-sponsored activity, responders who detect suspected initial access or compromise are urged to assume lateral movement and investigate connected systems and the domain controller. Apply that instruction to the relevant threat pattern; it is not a universal rule that proves attribution in every incident.
Update the scope deliberately
At each review, mark newly confirmed assets, removed assets, unresolved possibilities, and the evidence behind each change. A 2025 CISA advisory warns that incomplete scoping can leave an actor with continued access. Do not close the incident because the first host was cleaned while identity infrastructure, backups, or a supplier remain unexamined.
Phase 5: Analyze the intrusion without premature attribution
State sponsorship is a conclusion requiring technical and contextual analysis, not a label attached to a malware family, IP address, domain, or technique. Keep an attribution hypothesis separate from the operational facts needed to contain and recover.
Use a confidence record
| Field | What to enter |
|---|---|
| Observed fact | Precisely what a log, image, packet, identity record, or witness establishes. |
| Alternative explanation | Authorized administration, a compromised supplier, criminal activity, or an unrelated technical fault that could produce the same observation. |
| Threat-intelligence match | The advisory, technique, or indicator consulted, with its publication date and the exact match. |
| Context | Target selection, timing, objective, victimology, infrastructure relationships, and other nontechnical information available to the organization. |
| Confidence and owner | Current confidence level, limitations, reviewer, and next evidence needed. |
Correlate multiple independent observations and record which evidence supports each conclusion. A matching indicator can guide hunting, but it does not by itself establish who operated it or whether the actor is state-sponsored. Keep public statements and internal reports at the highest confidence level the evidence supports.
Phase 6: Report and communicate
Map obligations before sending details
With counsel and compliance owners, identify mandatory reporting duties arising from law, regulation, contract, sector rules, insurance, government programs, or customer agreements. Deadlines and recipients vary by jurisdiction and organization. Put the obligation, trigger, deadline, owner, approval path, and required content in the checklist, and verify the current rule at the time of the incident.
Consider voluntary cyber-authority and law-enforcement reporting
CISA state-sponsored-threat guidance encourages reporting to CISA and/or the FBI when appropriate. Newer CISA guidance also advises organizations to consider mandatory reporting obligations and additional voluntary reporting to appropriate agencies. Decide with counsel and leadership, then recheck the current official reporting channel rather than relying on an old phone number or web form.
Maintain a notification register
| Entry | Required record |
|---|---|
| Recipient | Agency, regulator, customer, supplier, insurer, or internal group. |
| Time and method | Timestamp, time zone, phone, portal, secure email, or other channel. |
| Information shared | Verified facts, uncertainty, indicators, impact, and requested assistance. |
| Response | Reference number, instructions, preservation request, deadline, and assigned follow-up. |
Control internal and external messaging
Route communications through the designated communications lead and legal counsel. Tell employees what actions to take and where to report suspicious activity, but do not disclose investigative details unnecessarily. Do not publicly name a state or group, describe data exposure, or promise restoration until the evidence and approval process support the statement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Phase 7: Eradicate, recover, and validate
Recovery begins only after the team understands enough of the scope to avoid restoring a known foothold. The exact order depends on the environment and applicable plan, but the checklist should require these decision points:
- Confirm the eradication hypothesis: identify compromised accounts, persistence, vulnerable entry points, malicious tooling, and connected systems that still require action.
- Remediate deliberately: remove persistence, rotate or revoke exposed credentials and tokens, close the exploited path, and apply mitigations while preserving required evidence.
- Restore from trusted sources: use known-good systems, configurations, and backups whose integrity and access controls have been assessed.
- Validate before reconnecting: test identity, logging, segmentation, endpoint controls, applications, and business functions; obtain system-owner approval.
- Monitor for recurrence: increase hunting and alert review for the indicators, techniques, accounts, and infrastructure associated with the incident.
- Close only with evidence: document why the actor is believed to be eradicated, what remains unknown, who accepted residual risk, and when heightened monitoring ends.
If the actor’s access cannot be confidently removed, keep affected systems contained and escalate the unresolved risk rather than declaring recovery complete.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Decide whether to add outside responders
Use internal responders when they have the skills, availability, authority, tooling, and independence required for the suspected scope. Consider an external incident-response or digital-forensics team when capacity or specialist expertise is insufficient, evidence handling is unusually demanding, the incident may become contentious, or responders need an independent view.
| Decision factor | Questions to answer |
|---|---|
| In-house capability | Can the team collect memory and disk images, analyze identity and cloud records, hunt laterally, and maintain evidence custody? |
| Scope and persistence | Does the event involve domain or identity infrastructure, backups, suppliers, multiple sites, or long dwell time? |
| Operational impact | Can internal staff contain safely while keeping critical services and OT functions operating? |
| Independence and privilege | Would outside specialists improve confidence, preserve privilege arrangements, or support regulators and law enforcement? |
| Contract readiness | Are scope, confidentiality, data handling, conflict checks, costs, and authority to act already defined? |
CISA guidance supports considering third-party help when expertise is needed; it does not rank providers or establish a particular vendor as appropriate.
Recommended Free Tools
Ready-to-use checklist layout
Copy these fields into your incident system and make each unchecked item an owned task.
Trigger and coordination
- ☐ Reporter, report time, systems, users, indicators, and original alert captured.
- ☐ Incident declared or declined with a recorded rationale.
- ☐ Coordination lead and technical lead assigned; decision authority confirmed.
- ☐ Leadership, system owners, security, IT, legal, communications, and continuity notified.
- ☐ Suspected, verified, and attributed states recorded separately.
- ☐ Secure communications channel and decision timeline opened.
Containment and evidence
- ☐ Isolation decision made for each affected asset, including operational impact and rollback.
- ☐ Backups, identity systems, management planes, and connected providers considered in scope.
- ☐ Volatile data, logs, memory, and forensic images collected before changes where practical.
- ☐ Evidence originals protected; acquisition, storage, access, and transfers recorded.
- ☐ OT or safety-sensitive isolation approved by operations and safety authority.
Scope, reporting, and recovery
- ☐ Initial access, affected hosts and accounts, privilege, lateral movement, persistence, data impact, and business impact assessed.
- ☐ Current advisories used as hunting hypotheses, with matches and limitations documented.
- ☐ Mandatory reporting obligations mapped with counsel; voluntary reporting decision recorded.
- ☐ Every notification, recipient, time, content, reference number, and follow-up assigned.
- ☐ Eradication and restoration use trusted sources; reconnection is validated by system owners.
- ☐ Recurrence monitoring, residual risk, lessons learned, and closure approval documented.
Common failure modes and fixes
Declaring attribution too early
Failure: A single indicator becomes a public claim about a government. Fix: separate observed facts from hypotheses, record alternative explanations, and require corroborating technical and contextual evidence.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Reimaging before collecting evidence
Failure: A rushed rebuild removes memory, persistence clues, or the timeline. Fix: coordinate forensic capture first when safe and practical; document any emergency exception.
Ignoring backups and identity infrastructure
Failure: A cleaned endpoint is restored while the actor retains privileged access or can corrupt recovery data. Fix: include identity, domain controllers, management planes, backup systems, and connected providers in scope reviews.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallApplying a federal procedure unchanged
Failure: A private organization assumes federal roles, deadlines, or channels apply automatically. Fix: use the CISA playbook as a baseline and map each step to your jurisdiction, sector, contracts, and operating model.
Isolating OT without an operating plan
Failure: A network action creates an unsafe or unacceptable physical condition. Fix: require operations and safety approval, define manual or alternate operation, and record the exception and review time.
Closing when the first host is clean
Failure: The response ends before persistence, lateral movement, or a supplier compromise is ruled out. Fix: require a documented eradication rationale, validated restoration, recurrence monitoring, and explicit acceptance of remaining unknowns.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
