On Monday morning, Lighthouse Library received an email that copied the familiar renewal notice for its lending platform. The subject said several accounts had to be “confirmed today,” and its link led to a page that looked almost identical to the real one. Marta, opening the building, did not click. She saved a screenshot, recorded the time, and alerted the incident channel. It was a small act, yet it produced a different morning from one filled with scattered messages: other people could see the same evidence, understand what was still unknown, and decide who would make each check.
Incidents become confusing when urgency distributes tasks without distributing context. One person changes a password, another calls a supplier, a third says the email might have been legitimate, and an hour later nobody can explain which account was used or what information was opened. Responding with judgment does not mean moving slowly in the face of a threat. It means keeping a log simple enough that the next shift does not have to guess at decisions, uncertainties, and needed support.
A log that creates a shared place#
Lighthouse Library had neither a security operations center nor a permanent technical team. It had a digital incident log with four fields: observed facts, decisions made, open questions, and people or services providing support. It was not a list of culprits or a form requiring specialist language. It was one place to write clear sentences: “10:07, email received at service@; link not opened”; “10:15, internal forwarding paused until the domain is confirmed”; “open question: did two patrons call the number on the page?”; “support: supplier contacted through the number in the contract.”
Lighthouse Library had neither a security operations center nor a permanent technical team.
Keeping these fields separate matters because informal conversations blend different things. “It looks like credential phishing” is a reasonable hypothesis, but not yet a fact. “Close every session” may be a useful step, but it needs to be connected to a reason and a person who takes it. “Ask IT” is not useful when no one knows the precise question or the channel through which help was requested. A log reduces this ambiguity without promising certainty the team does not possess.
It also protects the person who notices the first signal. Marta did not need to defend a diagnosis. She only had to record what she saw and avoid opening the link. When an organization expects the frontline person to prove an attack alone, it rewards silence. When it values an observation with a time, context, and reporting route, it lets doubt travel without turning into theatrical alarm.
First shift: contain without inventing a story#
The library's first shift covered opening and the early returns. Marta and Joel agreed on two low-risk actions: do not forward the message, and tell public-service staff not to use the link. They recorded those actions beside a decision they deliberately did not make: they would not ask users to reset their passwords yet. Too much remained unconfirmed, and an alarm sent too early could lead people to follow the false link in an attempt to “protect” themselves.
The difference between a measure and a reaction is that a measure can be explained. The team did not shut down every computer or delete the original email. It kept a copy in a restricted space and opened the supplier portal from a known bookmark, never from the notice. That independent check strengthened the suspicion without turning an intuition into certainty too soon.
The log also captured conditions around the response: the catalogue had to remain available for loans and returns; only two people were authorized to speak to the supplier; the social media account should publish nothing until it had verified wording. These notes may look administrative, but they prevent a technical incident from erasing a library's ordinary mission. Containment includes protecting the services that do not need to stop.
A good first entry does not attempt to solve everything. It makes clear what has been isolated, which evidence is being preserved, and what harm the team is trying to prevent. If someone later discovers that they clicked the link, they can add the fact without falling outside a story that has already been closed. The log exists so knowledge can visibly change as the facts change.
Second shift: hand over context, not merely an alarm#
At midday the second shift arrived. If it had received only a message saying “watch for a scam,” it would have had to repeat calls and questions. Instead, Leire read a brief timeline: which domain had been observed, which check had been made, which accounts showed no anomalous activity, and what remained unresolved. She could spend her time calling the supplier through the contract number and checking whether the email had reached internal lists.
A handover is a demanding test for any response. A useful instruction is not “keep watching.” It is “review the access log from 08:30 to 12:30 and record any sign-in from an unfamiliar device; do not reset credentials without coordinating with Joel.” That precision does not treat the next person as an executor. It gives a boundary, a reason, and a route for escalating a decision if circumstances change.
The call confirmed that the supplier had not sent the notice. Still, two uncertainties remained: the team did not know whether someone outside the library had entered credentials, and it did not know how many people had received the email. Leire wrote down both. Naming an uncertainty has a practical effect: it prevents the team from mistaking a system's silence for a negative answer. It also keeps a request for support from becoming vague. The supplier could say which logs it would provide and when; the municipal contact could understand that the library needed help identifying a wider campaign, not a reassuring statement.
During this shift, a patron said she had entered her password before reaching the library. The response was not to search for blame. The fact was added, the password was changed from a known page, her sessions were revoked, and she was told which signs to watch for in later messages. She provided useful information because she found a concrete route to repair. Coordination improves when someone reporting a mistake receives help rather than public judgment.
Third shift: end the day without ending the inquiry#
By late afternoon, the third shift inherited not an undefined problem but a bounded situation. The log listed completed actions, reviewed accounts, messages prepared for users, and one pending task: confirm the following day whether the supplier saw access attempts from new locations. By then some decisions could close — remove the internal alert after every team had seen it — while others needed to remain open — monitor the affected account for a week.
Closing a shift is not declaring that nothing happened. It is agreeing what belongs to whom and what evidence would justify a new decision. The library added a line of criteria: if an unknown access appeared, the service lead would call the supplier and assess resetting credentials for affected accounts; if none appeared, the lead would send users a short explanation of the scam and the safe channels. That preparation kept the next morning's decision from depending on whoever happened to read an email first.
The close also included an uncomfortable question: why had the false link looked so credible? The group discovered that the message used an old service name still printed on a notice in the computer room. Replacing the notice was not a dramatic fix, but it removed an accidental aid to the deception. Incidents reveal information about processes, language, and habits, not only about individual mistakes.
What must be written down so judgment can travel#
A useful log does not need to capture everything. It needs to preserve what allows another person to act with the same care. Record the time and source of a signal, the known scope, reversible actions already taken, preserved evidence, uncertainties that still matter, and the person or service able to decide the next escalation. It also helps to distinguish an instruction from an authorization. “Notify the supplier” does not authorize sharing a user database; “send this identifier and this time through the contract channel” defines an auditable scope.
The format must be accessible under pressure. If it requires twenty fields before someone can ask for help, people will abandon it. If it is an unstructured conversation, decisions will disappear. The library chose four fields because each answered a handover need: know, do, question, and seek support. A school, shop, or community group may use different words, but the principle carries across settings.
It is also wise to decide where the log lives. It should not remain in the same potentially compromised channel or hold passwords, unnecessary sensitive data, or unverified accusations. A link to evidence stored with limited access is preferable to copying it repeatedly. The security of coordination is part of coordination: there is little sense in avoiding a fraudulent link while distributing information through messaging that expands the harm.
Turning one incident into a practice of care#
Two days later, Lighthouse Library reviewed the log for fifteen minutes. It did not look for a heroic story; it looked for friction. The group saw that the supplier's number was in a file only Joel knew, substitute staff did not know where to leave an alert, and the old notice confused the service name. They agreed to publish the verified contact, rehearse a short handover, and review the public-facing text.
That review turns a one-off response into shared capacity. It does not mean the next incident will be identical. It means the team will have a way to recognize what it knows, state what it does not know, and request appropriate support without losing hours reconstructing conversations. Tools change, but the need for continuity between people returns.
The next time an urgent notice appears, do not distribute only the alarm. Open a four-line log and record what was seen, what was decided, what remains uncertain, and who can help. Then hand that context to the next shift. Under pressure, judgment is not a solitary trait: it is the information a team makes available so another person can care for the situation better than before.
