TAP TAP GO
Understand the decision
When an account problem occurs, record the service, approximate time, observed behaviour and action already taken. Distinguish what you know from what you suspect. A page that will not load is not proof of compromise; an unfamiliar account change deserves investigation but should be described accurately. Include a safe screenshot if it helps, after checking for private details. Never paste passwords or verification codes into the incident note.
A practical workflow
Route the note to the responsible account owner through the approved channel. Add the next decision needed, such as checking recent activity or contacting the provider. Keep a single working record so different team members do not repeat conflicting recovery actions. After resolution, document the cause only to the extent supported by evidence, then identify a practical process improvement. The note should support response and learning, not assign blame before the team understands what happened.
Hypothetical example
A profile suddenly displays an outdated brochure. The team records the time, affected link and recent publishing activity, then discovers a mistaken editor change. Because the report described the observation without assuming an attack, the team can correct the issue and improve its publishing checks.
Make it practical.
Use this checklist as you read. Checks are not stored.References & further reading
Further reading: CISA: Secure Our World ↗Published by Tap Tap Go. Product availability and eligibility vary by programme and market. About our stories.
