Establishing the facts.
WHAT TO ESTABLISH
How access was obtained What was accessed or taken When it started Whether it is still occurring Who is affected
WHY THE ENTRY POINT MATTERS MOST
Without closing it, the problem recurs.
WHERE TO LOOK
Login and access records Email rules and sent items File modification dates Financial transactions Device logs
WHAT THE TIMELINE TELLS YOU
How long access persisted, which determines what was exposed.
WHAT PEOPLE UNDERESTIMATE
How long compromises persist before discovery.
Weeks is common.
WHAT TO DOCUMENT
What you found, with times.
WHEN TO BRING IN HELP
Customer data involved Money lost Scope unclear You cannot establish the entry point
WHAT NOT TO CONCLUDE
That finding one thing means you found everything.
WHAT TO CHECK BEFORE CLOSING
That nothing remains: accounts, rules, tasks, access.
