Cybersecurity Phishing Report Standard Operating Procedure for Incident Reporting in Professional Services Operations

Scope

Included

This SOP applies to Professional Services teams carrying out Cybersecurity Phishing Report within the Incident Reporting process area and Operations department. It covers preparation, required inputs, execution, control checks, evidence, exceptions, approval or review where required, communication and closure.

The procedure should be adapted to the organisation's own systems, job titles, approval limits and record locations before operational use. Tasks outside the stated process, specialist decisions or circumstances requiring a different controlled procedure should be referred to the appropriate owner rather than forced through this workflow.

Outside this SOP

This SOP does not replace organisation-specific approval limits, specialist professional judgement, local legal requirements or site-specific controls.

Responsible roles

Primary owner: process owner or department supervisor. Supporting role: department manager. The primary owner coordinates and completes the operational record, the supporting role provides subject-specific input where required, and any designated reviewer or approver confirms that the control result and evidence are sufficient before closure.

Required information and systems

Primary working system or record location: the service desk or security incident platform, email-security tooling, identity platform and approved evidence location. Required working information: reporter identity, affected mailbox or user, suspicious message, sender address, message headers, links or attachments, screenshots, time received and whether any link, attachment or credential was used. Evidence retained at completion: original message or secure copy, message headers, screenshots, indicator analysis, quarantine or block evidence, credential or session actions, incident ticket and closure decision. Use the current approved forms, system records and controlled documents used by the organisation for this procedure.

Procedure overview

Cybersecurity Phishing Report starts when the relevant request, event or scheduled activity is ready to be processed. The process owner or department supervisor first verifies the required inputs and scope, then completes the three core actions defined for this procedure: instruct the user not to interact further with the suspicious message, preserve the original email and headers and record whether credentials, links or attachments were used. analyse the sender, headers, URLs, attachments and other indicators; search for related messages or activity and block or quarantine confirmed malicious indicators using approved security controls. contain any user or device impact by resetting exposed credentials, revoking sessions, isolating affected equipment where necessary and recording the final phishing classification and response.

Before closure, the record must pass the principal control check: confirm the suspicious message and indicators are preserved, affected accounts or devices are contained and required blocking, notification and escalation actions are complete. Failed checks or unresolved exceptions remain open with a named owner. The procedure is complete only when the result, evidence, approvals where applicable, communications and follow-up actions accurately describe the final operational position.

How this SOP helps

This document gives the responsible team a consistent way to complete Cybersecurity Phishing Report, verify the result and retain evidence that the required process was followed.

Before using this procedure

Confirm that role names, systems, approval routes, record locations and escalation contacts match the organisation using this SOP. Adapt any local legal, contractual, privacy, safety or regulatory requirement before operational use.