Prepare
Define contacts, critical processes and fallback operations before an outage.
United States · free resources
Coordinate your cyber incident response.
Coordinate an active incident with the free IT Emergency Navigator. Prepare U.S. contacts, internal reports and decision records with the templates below.
IT outage or suspected attack? Start the navigator →What do you need to do?
The free materials can be used without purchasing training. Choose according to your situation, rather than the name of a tool.
Handle an IT outage
During an outage, organise the situation, contacts and initial organisational steps. This is not a technical diagnosis.
Coordinate an incident
When a security incident is suspected, document roles, initial reports, decisions and handover. Involve your responsible IT team.
01Free
Templates for your team
Four editable pages for management, IT and business teams. Prepare together and keep them accessible during an incident.
- Role card with contacts and decision authority
- Initial internal report with known observations
- Incident log with decisions and handover
- U.S. specialist contacts and notification review
How to use the templates
Add contacts, deputies and approval authority, then review internally. Keep a protected copy accessible during an IT outage. The PDF is a print template without digital form fields. Copy extra log pages as needed.
Full ZIP package ↓No signup
02Free
First aid & checklists
For an urgent suspicion, contact your agreed IT responder first. These CyberDecisionLab tools support a structured handover.
Incident response checklistOrganize first steps, responsibilities and priorities.Ransomware first aidAssess warning signs and prepare a handover to IT.
Do not enter confidential incident details or credentials. First aid is not a malware scan or decryptor.
03Free
Rehearse a U.S. incident
Use fictional information. Do not change live systems, send real reports or call emergency contacts during an exercise.
- Your ERP stops and a ransom note appears. Who coordinates and how do you reach IT over a trusted channel?
- Your insurer requires an approved response provider. Who verifies the contact and authorizes engagement?
- Customer data from several states may be affected. Who engages counsel, preserves evidence and records notification decisions?
- IT proposes recovery. Who approves it, and how will orders and transactions be reconciled?
04Optional · paid training
Training for response teams
The blackout mission develops outage decision-making from an incident response and business continuity perspective.
Blackout mission for IT and continuity teamsPractice escalation, situation assessment and recovery decisions. View training and pricing.Topics and formatExplore the mission “Everything Stops”.
Templates, exercises and tools are available independently of any training purchase.
U.S. scope and international operations
These pages and downloads focus on U.S. businesses. Review notification duties with legal counsel based on affected data, states, industry and contracts. There is no universal 72-hour deadline. The navigator includes official contacts and links for further review.
For operations in multiple countries, assess each relevant jurisdiction. The NIS2 Management Check for EU requirements remains available as a separate learning resource. It is not a general U.S. compliance check.
Sources & usage notes
Paragamix GmbH · Sep 14, 2026 · U.S. edition 2.0
Review internal contacts, authority and procedures before operational use. Keep completed records secure. These organizational templates do not replace technical response planning or a case-specific assessment of external notification duties.