IT Emergency Card: A Fill-In Poster for When Things Go Wrong

The BSI sees its IT emergency card as a sign similar to the well-known “What to do in case of fire” poster. It puts three messages first: know the contacts for IT emergencies and how to reach them, pass on key information immediately, and take countermeasures only after consultation or on instruction. It is often hard to tell whether a malfunction or an attack has occurred. That decision should rest with the responsible people, not with the person who notices the emergency.

Print the next page on its own after filling in the fields: emergency numbers, availability and your decision on disconnecting from the network. Alternatively, create the card with the IT Emergency Card tool on tomoris.com using your own contacts and print it in A4. The pages after it are meant for emergency managers and IT.

• Stop working on the affected device
• Write down what you observed, photograph the screen with your work phone
• Take action only on instruction from the IT emergency number
• If you suspect malware: [unplug the network cable and turn off Wi-Fi] or [only on instruction]

Do not repair anything yourself, do not delete anything, do not make any payments. If people are in danger: police emergency number 133 or European emergency number 112.

1. 1

   Set the emergency number

   Enter a number that someone answers in an emergency, internally or at your IT service provider, plus a deputy. The BSI provides a field for the individual phone number on its card for this purpose.

2. 2

   Decide on network disconnection

   Decide whether employees who suspect malware should unplug cables and turn off Wi-Fi themselves. In case of ransomware, the Austrian Federal Criminal Police Office (Bundeskriminalamt) advises businesses to disconnect affected systems from the network immediately. The BSI advises employees to take action only on instruction. The card makes your decision unambiguous.

3. 3

   Post it

   In hallways, offices, workshops and at IT workstations, wherever employees should find it in an emergency (BSI). For employees who speak other languages, the BSI offers the card in ten more languages.

4. 4

   Introduce it in training

   The BSI recommends presenting the card as part of training and awareness programs and encouraging employees to report anything unusual.

5. 5

   Keep it up to date

   Check the numbers whenever staff or service providers change, and at least every six months. Once a year, make a test call outside office hours. This is a TOMORIS recommendation.

The BSI expressly allows organizations to copy and distribute its own card and fill in the fields. This TOMORIS card follows its content but is a separate version for Austria.

Whether a reporting obligation exists under the GDPR or the NISG 2026 is decided by management together with the emergency managers, not by the person reporting. When filling in the card, check phone numbers and availability on the bodies’ websites.

• Initial assessment: cyberattack or technical fault?
• Measures continuously coordinated, documented and communicated to everyone responsible?
• Logs, log files, notes, photos of screens and storage media secured forensically?
• Particularly time-critical business processes in focus?
• Affected systems and their internet connections disconnected, unauthorized access stopped?
• Backups stopped and protected from further interference?
• Extent of the spread determined, all attacked systems identified?
• Exploited vulnerabilities in systems and processes fixed?
• Police and authorities notified after coordination (data protection, reporting obligations)?
• Access rights and sign-in methods of affected accounts reviewed, for example new passwords and two-factor sign-in?
• Network monitored further after the incident?
• Affected data and systems restored or rebuilt?

The publishers stress that handling a cyberattack is always individual. The measures must be adapted to the IT, the type of attack and the goals of the organization (TOP 12, as of September 2019). An IT emergency manual helps with planning in advance.