Everyday Cybersecurity for Employees and Leaders Operating Playbook

1. Purpose

This vendor-neutral playbook helps non-technical employees and leaders handle common cybersecurity decisions during ordinary work. It covers suspicious requests, authentication, data handling, vendor access, incident reporting, remote work, and team routines. Adapt it to the organization's procedures, systems, sector, contracts, and law. Authorized security, privacy, legal, IT, HR, finance, procurement, and management owners retain decisions in their domains.

2. Core rule

Pause when identity, authority, recipient, access, or consequence is unclear. Verify through a trusted independent route. Protect information and accounts using only actions permitted by procedure. Preserve observable facts. Report promptly to the named internal owner. Do not turn useful first response into unauthorized investigation.

Roles and inputs

Inputs include the original request or alert, approved contact records, the organization's reporting route, relevant data classification, access ownership, supplier records, and any observable timeline or evidence that procedure allows the person to preserve. Roles include the employee or leader taking the first safe action, the line manager, service desk, security, privacy, legal, finance, procurement, HR, records management, and the accountable business owner. Use only the roles and inputs approved locally.

3. Suspicious request procedure

1. Stop before clicking, opening, replying, paying, sharing, approving, or changing access.
2. Identify the requested action and its possible consequence.
3. Inspect the sender, address, channel, timing, language, context, link destination, attachment type, and consistency with ordinary workflow.
4. Treat warning signs as reasons to check, not proof of malicious intent.
5. Verify through a contact or system already trusted by the organization. Do not use a contact path supplied only in the questionable request.
6. Record the original message location, time, requested action, visible discrepancies, and actions already taken.
7. Report through the approved channel. Follow specialist guidance before further action.

4. Password and authentication procedure

• Use a unique password for every account and an approved password manager where available.
• Never share passwords, one-time codes, recovery links, backup codes, or session tokens.
• Use the assigned multi-factor method or passkey. Protect the enrolled device and recovery path.
• Decline an authentication prompt you did not initiate. Do not approve it to make repeated prompts stop.
• Use the authorized service desk or recovery route when prompts, sign-ins, password resets, device changes, or recovery messages are unexpected.
• Change credentials or end sessions only through approved guidance when an event may need evidence or coordinated containment.

5. Data handling procedure

Before sharing or moving information, confirm:

1. Purpose: the business reason is legitimate and current.
2. Information: only the minimum content needed is included.
3. Recipient: the person's identity and responsibility are verified.
4. Channel: the system is approved for this type of information.
5. Access: permissions are limited to the right people and duration.
6. Lifecycle: storage, retention, transfer, archive, and disposal follow the assigned procedure.
7. Exception: any uncertainty is routed to the responsible owner before disclosure.

Information can become sensitive through combination even when each item looks ordinary. A project name, schedule, employee assignment, price, client note, and link can reveal more together than separately. Local classification and context govern the decision.

6. Collaboration and AI-tool procedure

Use only approved tools and approved identities. Read the tool's organizational guidance before entering information or connecting a repository. Never paste real passwords, authentication material, confidential records, personal data, client files, supplier banking data, vulnerabilities, suspicious attachments, or live incident evidence into an unapproved AI service.

For an approved learning or drafting task, prefer fictional, synthetic, or genuinely sanitized context. Ask the tool to structure, compare, summarize, or critique. Check every consequential statement against the source and your professional judgment. A polished response does not establish identity, permission, accuracy, approval, or legal status.

7. Vendor and third-party procedure

Before a supplier receives data, access, or integration:

• define the business purpose, owner, users, systems, data categories, access level, locations, dependencies, and expected duration;
• collect the organization's required assurance, privacy, contractual, financial, and incident-contact information;
• route specialist questions to the correct reviewer;
• document exceptions and the person authorized to decide them;
• grant only approved minimum access after the required decision; and
• set ownership, review, renewal, expiry, and removal points.

During review, confirm that the need still exists, the owner is active, authentication and access remain appropriate, unresolved exceptions have owners, and offboarding can be completed. Do not interpret a questionnaire response or certificate as a guarantee of security.

8. Incident handoff procedure

Create one concise internal record with:

• purpose and urgency;
• chronological observations with times;
• affected account, device, process, vendor, system, or information category;
• facts, indicators, interpretations, and unknowns separated;
• actions already taken and their exact status;
• preserved evidence and approved location;
• current business safeguard;
• support or decision requested from each owner;
• external communication boundary; and
• next update time and coordinator.

Do not delete or alter evidence unless procedure requires a protective action and explains how to preserve the original state. Do not browse an alleged attacker's infrastructure, test a vulnerability, access another person's account, contact an outside party, or declare a breach or crime without authority.

9. Manager operating rhythm

Daily and event-driven

Keep reporting routes visible. Respond calmly to concerns. Maintain any payment, sharing, access, or communication pause needed for coordinated review. Confirm that the reporter receives the next safe instruction.

Monthly or locally approved cadence

Review recurring access exceptions, broad sharing, lost devices, supplier ownership, overdue actions, reporting quality, and friction in support routes. Frequency must follow local risk and procedure; this model does not create a universal schedule.

Lifecycle events

Check account, data, equipment, and supplier responsibilities during onboarding, role change, extended leave, project closure, contract renewal, and exit. Ensure that ownership transfers and unnecessary access is removed by the authorized team.

Periodic exercise

Run a bounded fictional scenario that tests recognition, verification, first action, reporting, handoff, and coordination. Measure process behavior, not fear. Record what confused people, which contact or approval was unclear, and which improvement will be completed by whom and when.

10. Escalation guide

11. Quality checks

A good response is timely, factual, concise, minimum-necessary, and routed. It records what changed and what did not. It names who can decide. It makes the next action clear. It does not hide uncertainty, turn suspicion into accusation, or copy sensitive material into a broad audience.

Review these questions:

• Did the person pause the consequential action?
• Was verification independent of the questionable request?
• Were credentials and sensitive information protected?
• Are facts separated from conclusions?
• Is evidence preserved in an approved location?
• Does every requested decision have an owner?
• Is the next update clear?
• Can the process return to normal safely after review?

12. Closing standard

Close a real event only through the organization's authorized process, after the responsible owners have documented the decision, required follow-up, communication boundaries, and any remaining risk or uncertainty.