Identify the information and accounts that matter most, then choose protections and recovery routes you can maintain. Keep the plan private, start with manageable changes and reduce unnecessary reliance on a single device, account or person.
Evidence checked October 17, 2026 (America/Denver). Version 1.0. Original-source desk review; no practical testing.
What this guide helps you do
An introductory privacy, account-care and recovery-planning guide. It is not an investigation of a compromised device, a personalized high-risk security plan, an identity-theft remedy determination or a guarantee against attack. Actual provider instructions and appropriate specialist help govern an incident.
Decide what you need to protect
Privately list important information, devices and accounts, who can access them and what would happen if access were lost or information were exposed. EFF’s planning method asks about assets, plausible adversaries, consequences, likelihood, feasible effort and allies. Use those questions to select priorities. The filled-in worksheet may itself be sensitive; it belongs in a protected private record, not a public guide or shared notice. Source: EFF Your Security Plan.
Trace access and ordinary dependencies
For each priority account, identify the person who owns it, the device and email address it depends on, and the current sign-in and recovery routes. Ask which information the service needs and which permissions or old accounts you still use. Review actual settings and terms through the provider’s known official route. Record questions before removing access or deleting material you may need. Plan changes so that you can still recover your own work.
Strengthen important accounts carefully
Follow current provider guidance for strong, distinct credentials, a suitable password manager where useful, and multifactor authentication. CISA’s current awareness page highlights these practices alongside phishing awareness and updates; the FTC explains account-protection options. Keep the relevant recovery arrangements usable and private before changing a sign-in method. This guide does not choose a product or establish that any one method prevents every kind of compromise. Source: CISA cybersecurity-awareness core practices. Source: FTC personal-information protection guide.
Verify unexpected requests through a known route
Pause when an unexpected message asks for a password, payment, download or urgent action. The FTC advises reaching a company through a genuine contact route you already know rather than the link in the unexpected message. Apply the same care to purported support staff. Keep the original message if it may be needed for a report, while avoiding further interaction through its links or attachments. Source: FTC personal-information protection guide.
Keep devices and recovery information usable
Use the actual vendor’s update and support instructions for the devices and software involved. Check how an essential task would continue if one phone, account or connection were unavailable, and keep essential contact information in a usable private form. Coordinate with the person who provides technical help without casually sharing credentials. A backup and restore plan is a separate task to complete; simply knowing a password is not a recovery test. Source: CISA cybersecurity-awareness core practices.
Prepare a response route and revisit the plan
Write down how to reach the relevant provider and a trusted helper, and where to find official account or identity recovery guidance. The FTC page supplies those leads; its linked workflows were not tested here. If something appears wrong, use a known official route and obtain help appropriate to the incident. Revisit the plan after changes in people, accounts, devices or risk, and record which protections were actually checked. Source: FTC personal-information protection guide. Source: EFF Your Security Plan.
A record you can use
| Record | What to write down |
|---|---|
| Private priorities | Important data/devices/accounts, consequences, likely risks and trusted help. |
| Access map | Owner, permissions, required email/device, official settings and recovery routes. |
| Account care | Current provider instructions, credentials/MFA choice and usable recovery arrangements. |
| Unexpected requests | Known contact route, verification habit and reporting lead. |
| Continuity | Updates/support, essential contacts and alternatives when one dependency fails. |
| Response and review | Provider/helper route, last checks, unresolved gaps and change triggers. |
Learning route
- Prioritize: Name the information and likely harms.
- Trace: Map access and recovery dependencies.
- Protect: Use current account and device guidance.
- Review: Keep trusted help and response routes.
Checklist
- The completed security record stays private.
- Priority accounts have identified owners.
- Sign-in changes preserve a workable recovery route.
- Unexpected requests have a known verification route.
- Updates, support and continuity needs are recorded.
- A named person can revisit the plan after changes.
Resources and their limitations
EFF Your Security Plan
EFF Your Security Plan — Electronic Frontier Foundation / Surveillance Self-Defense
Use. Privately identify the information and devices to protect, who can access them, likely harms, feasible effort and trusted allies. Revisit the plan when circumstances change.
Access and cost. Public reading; actual software support, equipment, storage, training and services may have separate costs.
Review and limits. The page shows last reviewed October 27, 2023. A planning method, not a personalized threat assessment, product recommendation or complete response plan for a targeted incident. Linked glossaries, tools and installation guides were not tested. Do not publish the filled-in security worksheet.
CISA cybersecurity-awareness core practices
CISA cybersecurity-awareness core practices — Cybersecurity and Infrastructure Security Agency
Use. Read the current four core practices, then follow the relevant provider’s current instructions for the actual account or device and keep a workable recovery route.
Access and cost. Public reading; actual software support, equipment, storage, training and services may have separate costs.
Review and limits. The requested /secure-our-world URL redirected to the current awareness-month page. Selected individual practices are used; event details, super-intelligence claims, organizational services and linked media were not evaluated. No account, device, authentication setting or protection outcome was tested. The page does not guarantee freedom from compromise.
FTC personal-information protection guide
FTC personal-information protection guide — Federal Trade Commission / Consumer Advice
Use. Read the account and phishing sections, use a known official route to contact a provider, and follow the relevant recovery lead if an account or identity problem occurs.
Access and cost. Public reading; actual software support, equipment, storage, training and services may have separate costs.
Review and limits. The page is dated November 2024. Linked password products, authentication instructions, recovery pages, videos and IdentityTheft.gov workflow were not individually tested. This resource review is not an individual incident investigation, recovery result or legal remedy determination.
Historical starting point
The Spring 1969 Data Study page treats information as something that must be organized and retrieved, including a personnel-record example. Privacy, account access, data minimization and recovery are explicit modern extensions. No historical personal-data practice, terminology or claimed adequacy of a record system is adopted as a present-day privacy standard. Locator: Whole Earth Catalog — Spring 1969, PDF page 68, printed page 66.
Related guides
- Backups and digital preservation — browse the Public Library
- Digital rights and platform dependence — browse the Public Library
- Emergency and low-dependence communication
Last substantive desk review: October 17, 2026. Sources retain their own dates and geographic limits. Local services and individual products require a fresh check at the time of use. For a correction, retain the page title, source and passage in question.
