CISA's response checklist for a security advisory comes down to three actions: fix your passwords, lock down your accounts, and freeze your credit. The federal cybersecurity agency and the Federal Trade Commission each publish specific, concrete steps for exactly this moment — not vague caution, but a sequence you can complete in an afternoon. This checklist pulls those steps into one place, in the order that protects you fastest. It covers what to change first, which accounts matter most, and what a credit freeze actually stops versus what it leaves exposed.
Table of Contents
- Fix Your Passwords First
- Which Accounts to Secure First
- When and How to Freeze Your Credit
- What a Freeze Doesn't Cover
- Freezing Credit for Children and Dependents
- Frequently Asked Questions
Fix Your Passwords First
Start with passwords, because a reused or weak one is what lets a single breach cascade into many. CISA's "Secure Our World" program, launched September 26, 2023, tells individuals to use passwords that are long, random, and unique to every account — and to create and store them with a password manager rather than memorizing variations. If you've received a breach notice, the FTC's guidance is more specific about what to do with that particular account.
The FTC's identity-theft guidance instructs you to log into the exposed account, change its password, and change the username too if the service allows it. Critically, it also tells you to apply that same fix to every other account that shares the compromised password — a breach at one company is a problem for every account that reused its credentials. A password manager removes the excuse for reuse. Once it generates and stores a unique password per site, there's no mental cost to following CISA's rule, and no reason to fall back on a familiar password across multiple logins.
Which Accounts to Secure First
Not every account carries equal risk, and triage matters when you're working through a long list of logins. CISA's program tells users to turn on multifactor authentication (MFA) — a second verification step beyond a password, such as a code sent to your phone — for every account that offers it, but it specifically prioritizes email, financial, and social media accounts as the most important to protect. Email deserves the top spot because it's usually the recovery path for everything else.
Anyone who controls your email can reset passwords on your bank, your social accounts, and most other services tied to that address. Financial accounts are the direct target of fraud, and social media accounts are frequently hijacked to run scams against your contacts. This triage reflects why Congress directed CISA to build a program with concrete steps in the first place: individuals and small businesses needed a specific sequence, not general caution, to protect themselves after a breach or advisory.
- Email — enable MFA immediately; this is the recovery key to everything else
- Banking and financial apps — enable MFA; check for login alerts
- Social media — enable MFA; review which apps have account access
- Any other account offering MFA — enable it, lower priority but still worth doing
When and How to Freeze Your Credit
A credit freeze restricts access to your credit report, which stops lenders from approving new credit in your name. Since September 21, 2018, under the federal Economic Growth, Regulatory Relief, and Consumer Protection Act, credit freezes and fraud alerts are free nationwide, and a freeze request made online or by phone must be placed by a credit bureau within one business day. You can also use a fraud alert instead of or alongside a freeze.
The same 2018 law extended the standard fraud alert from 90 days to one year, and you only need to contact one of the three nationwide bureaus — Equifax, Experian, or TransUnion — which is then required to notify the other two on your behalf. One limitation to check: fees paid for a freeze before the 2018 law took effect are not refunded, even though every freeze or lift requested since is free. If you froze your credit years ago and paid a fee, that payment stands, but any action you take now costs nothing.
- Freeze: blocks new credit from being opened in your name; best after exposure of your Social Security number or other identity data
- Fraud alert: lasts one year, requires lenders to verify your identity before extending credit; faster to set up since one bureau notifies the others
- Both are free, and placing or lifting either one costs nothing going forward
What a Freeze Doesn't Cover
A credit freeze has a specific scope, and misunderstanding it leaves a gap. A freeze blocks lenders from pulling a new credit report to open an account in your name, but it does nothing to stop charges on accounts that are already open. That means a freeze has to be paired with active monitoring of your existing statements — checking accounts you already hold for charges you didn't make.
The freeze stops new fraud; it doesn't catch fraud on accounts a criminal already has access to. The FTC recommends two complementary steps here. Accept any free credit-monitoring service the breached company offers, since it's already paid for and watching for new activity. Separately, pull your own credit reports at annualcreditreport.com to look for accounts you don't recognize — monitoring services and self-checks catch different things, and neither replaces the other.
Freezing Credit for Children and Dependents
Identity thieves target children and dependents precisely because nobody is watching their credit. The same 2018 law lets parents and guardians place a free credit freeze on a child under 16, or on a dependent they hold power of attorney or conservatorship over.
A freeze on a minor is useful precisely because a credit file shouldn't exist yet — if one does, or if a lender can open an account, that's a signal of fraud rather than normal activity. The process requires contacting each of the three bureaus directly, since a minor's freeze isn't typically something one bureau can relay to the others the way an adult fraud alert can.
Frequently Asked Questions
Should I set up a fraud alert or a credit freeze first?
A fraud alert is faster because contacting one bureau notifies the other two, while a freeze request to each bureau must be processed within one business day regardless. Many people use both.
Does a credit freeze stop someone from using my existing credit card?
No. A freeze only blocks new credit from being opened in your name; it does not stop charges on accounts already open, so you still need to monitor existing statements.
Can I freeze my child's credit even though they've never had a loan?
Yes. Parents and guardians can place a free freeze on a child under 16 under the 2018 federal law, which is useful precisely because no legitimate credit file should exist yet.
You Might Also Like
- Cybersecurity — City Government Hack Response Checklist: Passwords, Accounts, and Credit
- Cybersecurity — MOVEit Breach Response Checklist: Passwords, Accounts, and Credit
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit