A clear account of what you observed helps the response team ask better questions and coordinate the next action.
Start with the observation
Describe the event that prompted the call: a sign-in alert, an unavailable service, an unexpected message or a report from a provider. Include when it was noticed and the time zone. Keep observations separate from assumptions. Saying that files cannot be opened is more precise than claiming a particular ransomware family caused the problem before anyone has established that fact.
Explain the business effect
Identify which activities are interrupted and who depends on them. A single unavailable application may be more important than many affected devices if it supports a critical operation. Explain any safety concerns, deadlines and temporary workarounds. This context helps the response team understand priorities without treating every system as equally urgent.
List actions already taken
Record account changes, restarts, network restrictions and messages sent to providers. Include who acted and approximately when. These details can explain gaps or changes in the evidence and help avoid contradictory actions. If you do not know whether somebody changed a system, record the uncertainty rather than reconstructing a confident account from memory.
Identify the people who can help
Have contact details for the service owner, internal IT lead and relevant providers. Clarify who can approve access or operational changes. Where other advisers are involved, establish a shared understanding of responsibilities. The purpose is to make the next decision possible, not to assemble every stakeholder into an unstructured call.
Agree how sensitive information will move
Do not place passwords, detailed vulnerabilities or confidential records in the initial website enquiry. Describe what evidence exists and arrange the appropriate exchange method with the authorised team. A contact form is useful for starting a conversation; it is not a substitute for the evidence-handling arrangements of an agreed engagement.
Confirm what happens next
Before ending the first discussion, clarify who owns the next action, what information is needed and how the next update will happen. Confirm availability and engagement scope directly. A useful first conversation reduces ambiguity even if it cannot immediately explain the whole incident. Keep the resulting notes with the incident record.
Related service: Incident response. Further guidance: CISA #StopRansomware Guide.