Employees need a clear way to question an unusual request and get help when something feels wrong. Make those routes part of how the business works, alongside the technology protections around accounts, devices and email.
Make the reporting route easy to find
Tell employees where to send a suspicious message or report an unexpected account prompt. Include an alternative contact if the usual channel is unavailable or seems affected.
Explain what useful information to share, such as when the message arrived and what happened. Avoid asking staff to investigate the issue themselves before reporting it.
CISA’s online safety guidance emphasizes recognizing and reporting suspicious messages, along with strong passwords, multifactor authentication and software updates. Apply those ideas through the arrangements appropriate to your business.
Give unusual requests a checking process
Discuss how staff should verify an unexpected request involving account access, business information or a change to payment details. Agree the authorized contact route in advance rather than relying on details supplied by the unusual message itself.
Make clear who can approve the action and how an employee can pause while checking. The process should work when a familiar person appears to be asking urgently, as well as when the sender is unknown.
Coordinate financial approvals with the people responsible for the business’s payment controls.
Support people who raise a concern
Thank employees for reporting a possible problem and tell them what to do next. Keep the response practical, especially if the person has already clicked, replied or shared something.
Managers should know how to escalate the concern without spreading uncertain claims. Share examples in a way that helps employees recognize the situation and understand the agreed process.
If you plan awareness activities, discuss their scope and delivery rather than assuming a particular training product or simulation program is included.
Connect the people process to the technology team
Ask who manages account access, devices and email, and how that team receives reports from employees. Include new starters, departing employees and people working remotely in the discussion.
ProIncident’s Fully Managed IT includes everyday support, employee onboarding and offboarding, account access and Microsoft 365 help. Cybersecurity is part of the standard managed service, with protection for people, accounts, devices, email and data.
See Cybersecurity Services and Multi-Location & Remote Teams for the wider relationship.
Frequently asked questions
Should someone report a message if they are unsure?
Give employees a route to ask. They should understand how to raise the concern without needing to prove that an attack has occurred.
Does a verification process prevent every attack?
No. Combine a clear verification procedure with the supporting protections, then review how they work in practice.
Does ProIncident include a specific training program?
Discuss current delivery and the scope for your business before assuming a particular training or simulation service is included.
Give your people a team they can reach
Employees should know whom to ask when something feels wrong. Discuss an ongoing support relationship that gives your people a clear place to turn.