🗂️ Staff and department personnel

Before Prepare

• Enable MFA on every work account, especially email, finance, HR, student information, and vendor portals.
• Verify wire transfers, banking changes, and vendor payment updates by phone using a number you already have on file — never one in the email.
• Lock your screen whenever you step away. Use a privacy filter for shared spaces.
• Keep approved software only. Ask IT before installing anything that touches campus data.
• Know where your data lives. List the systems your job depends on and confirm they are backed up.
• Maintain printed and offline copies of critical contact lists in case email is unavailable.
• Train new hires and student workers on phishing reporting from day one.

During Respond

• If a tool stops working, files are renamed, or a ransom note appears, disconnect from the network and call IT — do not email about it from the affected device.
• Stop sending or approving payments until IT confirms the environment is safe; this is a common attack window.
• Do not destroy artifacts — keep the screenshot, the email, the file, the URL.
• Use approved out-of-band channels (phone, signed-in-app messaging) to coordinate with your team.
• Refer external inquiries to the official communications lead. Don’t speculate on cause or attribution.

After Recover & learn

• Reconcile financial activity for the impacted period; verify against bank statements directly, not internal reports that may be tampered with.
• Review vendor access; revoke anything no longer needed and re-credential what stays.
• Update standard operating procedures based on what worked and what didn’t.
• Re-train staff on the specific lure that triggered the incident.