IT Emergency Navigator · free

IT outage: first steps and a free emergency plan

Prepare your IT emergency plan with Word and PDF templates. If email, cloud or ERP is already unavailable, use the interactive checklist to coordinate your first response.

Free · no signup · Navigator inputs stay in your browser

See a worked example ↓

The interactive navigator requires JavaScript.

Reach your known emergency contact, record observations and coordinate backup communications and continuity.

Printable continuity worksheets

01 · Record the situation

What is not working right now?

Record confirmed observations. You can leave unknown details open.

02 · Confirm contacts

Who is taking the lead, and how will you connect?

Use known contacts from your response plan. This tool does not send reports or messages.

External help for cyber incidentsUnited States · official resources and your own contacts

United States: involve your incident lead, IT team and specialist legal counsel early. Reporting to an agency does not replace your contracted technical response team.

Cybercrime / extortion

FBI & IC3

For ransomware, contact your local FBI Field Office and file a report with the Internet Crime Complaint Center.

Find your FBI Field Office ↗
Open IC3 ↗

Source: FBI ransomware guidance ↗

Incident reporting / guidance

CISA Operations Center

An official contact for cyber incidents. A report does not guarantee individual technical assistance.

24 hours · 7 days

Call +1 844 729 2472
Open CISA reporting options ↗

Source: joint agency advisory, April 7, 2026 ↗

Technical support

Forensics & cyber insurance

Activate your IT provider and contracted digital forensics and incident response team. Confirm approved providers, scope and costs with your cyber insurer. Preserve evidence and coordinate recovery.

FTC data breach response guide ↗

Record your contacts below, including availability and time zone from your contract or policy.

Legal / notifications

Legal / Breach Counsel

Specialist counsel reviews notification duties based on affected people, states, data types, industry and contracts. Record the responsible role and decisions in your log.

FTC notification guidance ↗

There is no universal 72-hour deadline. The navigator does not make a legal determination.

U.S. considerations to review with counsel

State laws: consider the affected information and people's states of residence. Determine the relevant agencies and notification duties for the specific incident.
HIPAA: for covered entities and business associates after breaches of unsecured protected health information.
SEC: covered domestic registrants generally have four business days after determining materiality, not after discovery; review applicable exceptions.
Financial institutions: review the relevant regulator's requirements and the FTC Safeguards Rule where applicable.
CIRCIA: separately verify applicability and current effective requirements for critical infrastructure. This tool calculates no reporting deadline.
Ransom payments and OFAC: payments may violate U.S. sanctions. Involve legal counsel, your insurer and law enforcement.
Business in the EU: additional obligations may apply. NIS2 is not a general U.S. compliance framework.

Internal coordination

Coordinator / backup Coordinator contact status Available backup channel Next status update selected time zone

Roles to inform

Your emergency contacts

Use verified phone numbers from your own records. All fields are optional and included in your exports. Enter one phone number with its country or area code per field; append any direct-dial extension as digits.

IT provider / contracted support

IT / service provider contact

IT provider phone

IT provider availability IT provider contract / ticket reference Provider response

Add forensics / incident response

Contracted or designated incident support

Forensics / incident response contact

Forensics phone

Forensics availability Forensics contract / ticket reference

Add cyber insurance

Cyber insurance claims contact

Cyber insurer / claims contact

Cyber insurance claims phone

Cyber insurer availability Policy / claim reference

Add legal counsel

Legal / breach counsel

Legal contact

Legal counsel phone

Legal counsel availabilityEngagement / case reference

Keep your working record.

Closing or reloading this page discards inputs you have not exported.

Reload your JSON here to resume later. Exports contain your information; store them securely. The PDF button opens the print dialog: choose “Save as PDF”.

Prepare before an outage

IT emergency plan: free templates for your business

Five worksheets help IT, management and operations agree on contacts, critical activities and fallback procedures. Edit the Word file or complete a printed PDF. These English templates are the U.S. edition.

What the templates cover

Emergency contacts, backup roles and fallback communication
Critical activities and the IT, data and providers they depend on
Approved fallback operations and conditions for recovery
A team exercise, actions, owners and review dates
U.S. incident contacts and questions for your legal team to review

Download directly

No signup required. Use the templates internally, adapt them and share them with clients free of charge.

Download Word templates Download PDF templates

5 pages · U.S. edition · editable Word · printable PDF

Make the plan specific to your organization

Enter your actual roles and procedures, have the responsible teams review and approve them, and keep a current copy accessible without the company network. These worksheets are a starting point, not a complete continuity handbook. Do not include passwords; protect completed documents. For international operations, have the relevant teams review local requirements.

The template and incident log serve different purposes: The template records your preparations. The navigator records the current situation during an outage; its PDF export contains the information you enter there.

Worked example · fictional information

Email and ERP are down: an example situation record

An illustration of what to enter in the navigator. The cause is initially unknown, and the team records observations separately from decisions. All example times use America/Chicago.

Situation · 9:10 a.m.: The order-service team cannot access email or ERP. New orders cannot be entered into ERP. The cause and expected recovery time are not yet known.
Coordination · 9:15 a.m.: The operations lead coordinates the response, with the order-service team lead as backup. The known IT provider has been reached using the verified emergency number. The team uses its prepared fallback communication channel.
Continuity · 9:25 a.m.: In this example, the operations lead authorizes the previously prepared, numbered paper order process. Staff do not promise delivery dates. Records are stored securely; other activities remain paused until assessed.
Next update · 9:40 a.m.: The coordinator checks the IT status and outstanding orders. Operations resume only after technical review and business approval; the business team checks a test order and reconciles paper records with ERP in a controlled process.

These times and decisions illustrate a fictional response. They are not deadlines or approvals for your organization, and they are not copied into your navigator inputs.

A completed set of example worksheets

The separate worked example shows a fictional Illinois office supplier preparing for a power failure: roles, fallback contacts, paper order intake and improvements from a team exercise. Reuse the structure and adapt the content to your organization.

Worked example as PDF Worked example in Word Record your own situation ↑

Organize the first 60 minutes

What should you do during an IT outage?

An outage can disrupt communication, order processing and other critical activities at the same time. Whether the cause is a technical fault, a provider disruption or a cyberattack may not be clear at first. Your team still needs a shared situation record, clear responsibilities and a documented next step.

1. Record observations

Note which services are affected, when the disruption was first observed and which activities have stopped. Separate confirmed observations from assumptions. An outage alone does not prove an attack; pass signs such as ransom notes, unfamiliar sign-ins or unexpected encryption to the responsible IT or incident response team promptly.

2. Activate contact arrangements

Identify the response lead and use your prepared contacts for IT, management and providers. Involve specialist response, insurance or legal contacts as appropriate. If email or collaboration tools are affected, use a previously approved fallback channel. Coordinate technical actions with IT so evidence and recovery options are preserved.

3. Agree on fallback operations

Prioritize the business activities that need to continue. Use prepared fallback procedures approved internally for the current situation, and record owners, authorizations and recovery criteria. The navigator does not determine whether a system is safe; that assessment belongs to the responsible specialists.

4. Keep a decision log

Record contact attempts, decisions, open questions and the next update time. Export a PDF for handover between teams or shifts; save JSON to resume the record later. Do not enter passwords, access tokens or confidential original messages, and store exported files securely.

What does the outage checklist provide?

A structured record of affected services, contacts, tasks, fallback operations and decisions. Inputs remain in your browser and are saved only when you export them. Use it alongside your organization’s continuity plan and prepared handbook. It does not replace technical analysis or advice from your legal team. The organizational workflow draws on NIST SP 800-61 Rev. 3.

Open the free outage checklist ↑

Usage & attribution

Free online for your own business use. Please retain the Paragamix attribution and usage notices. Publishing or distributing the navigator on other websites, as your own product, or with its attribution removed requires prior written permission from Paragamix GmbH. You may edit and share your own inputs and records. Separate permissions for Word/PDF templates, third-party rights and mandatory statutory rights remain unaffected.

These terms apply to the navigator, its interface and software, not to your incident information. Links to the original page are welcome.

Original version: https://www.paragamix.com/cyber-tools/it-emergency-navigator/

Request permission: info@paragamix.com

What does the navigator do?

The navigator helps coordinate email, cloud and ERP outages: situation, contacts, actions, continuity and a log. Your inputs change the suggested tasks. Tasks that no longer fit remain in the export with their previous status.

The country profile selects regional guidance without determining legal jurisdiction. Multiple countries may be involved. Entered times use the selected time zone; changing it does not convert existing times. Older files initially have no country profile or time zone. Confirm these before handing over a record.

The first 60 minutes describe an initial orientation period, not a deadline. The tool does not inspect systems or provide technical, legal or operational approval. Use it alongside your own response plan.

What happens to my inputs?

Your inputs are processed only in this browser's memory. They are not sent to Paragamix or an AI service and are not saved automatically. This tool page uses no response cookies, local or session storage, or analytics.

Only exports you initiate retain your inputs. Online page and file requests may generate server access logs, which do not contain your answers.

References & saving records

Independent Paragamix tool · Version 1.3 · Sep 14, 2026. The organizational workflow draws on NIST SP 800-61 Rev. 3 / CSF 2.0, CISA and FTC guidance. It does not certify compliance.

Opening the navigator requires internet access and JavaScript. Save your completed record as a PDF through the print dialog so it remains readable without internet access. Also export JSON to resume later by loading it here. Keep these files protected and accessible to your authorized team.

Recommend this free tool

Use this tool without registration and link to it from internal security pages, wikis, customer information or resource lists.

Direct link

Free · no personal account · do not enter sensitive company data. Use neutral labels in optional fields. See this page for methodology and sources.