Use your browser’s Print command to print this one-page handout or save it as a PDF. Fill in the company details before giving it to staff.
PC NINJA · STAFF HANDOUT
Staff cybersecurity checklist
Malware, spam & phishing: everyday rules for safer work.
Company:
Review date:
IT / incident contact & phone:
Backup contact & phone:
Approved password manager:
Approved message-reporting method:
Every staff member
Pause before opening unexpected links or files. Use known apps or saved bookmarks for sign-ins. A familiar sender name is not proof.
Verify payments and sensitive requests independently. Use a known number and the company approval process—not contact details in the message.
Report phishing using the approved method. Do not reply, forward suspicious attachments to coworkers, or click suspicious unsubscribe links. Mark ordinary junk as spam.
Do not save work passwords in Google Password Manager or the browser’s built-in manager. Use the company-approved password manager; do not sync work passwords to personal accounts.
Use strong, unique passwords. Never share passwords or verification codes, or keep them in email, chat or unprotected files.
Use required multifactor authentication. Reject and report unexpected sign-in approval requests. Never give a caller a sign-in code.
Install only approved apps and extensions. Ask IT first. Do not enable macros, paste website commands or bypass security warnings.
Allow required updates and restarts. Do not disable antivirus or other protection. Report failures and warnings.
Lock your screen and protect files. Use approved storage and sharing. Do not connect unknown USB drives or send business files to personal accounts.
Report mistakes immediately. Tell IT, your manager or your supervisor if you clicked, downloaded, entered credentials or approved an unexpected sign-in. Quick, honest reporting matters.
If you clicked: Stop interacting and contact IT, your manager or your supervisor through a trusted method. If malware is suspected, disconnect Wi-Fi/network cables if safe and consistent with your response plan. Do not reconnect, delete evidence, run cleanup tools, restart or shut down unless IT directs you. Report any credentials entered; IT may need to reset passwords and revoke sessions.