Lock the doors before someone tries them.

1. Start with email, your password manager, financial accounts, your device account, and your mobile carrier.
2. Generate long, unique passwords wherever passwords are still needed. Prioritize reused, weak, or exposed passwords.
3. Protect the password manager with its supported strong sign-in method and keep its recovery instructions somewhere you can reach without opening that vault.

Checked when: Your priority accounts have unique passwords, and you know how to regain access to the vault.

1. Prefer phishing-resistant options such as FIDO security keys when available. Authenticator codes are another option; SMS adds protection when stronger options are unavailable.
2. Check how you would restore an authenticator after replacing your phone.
3. Never approve an unexpected sign-in prompt or give a caller a one-time code. Authenticator codes can still be phished.

Checked when: Password-based priority accounts have a second factor and a documented fallback.

1. Create a passkey from the account's own security settings on a device you control.
2. Check whether it syncs through a credential provider or stays on one device or security key.
3. Keep an independent way back in if that device or the account that syncs your passkeys becomes unavailable.

Checked when: You can sign in with a passkey and explain what happens if its device is lost.

1. Consider a FIDO security key for important accounts that support it. A hardware key can hold passkeys or act as a second factor.
2. Register and test a second key where supported. Keep it securely apart from the everyday key.
3. Check the service's recovery rules before enabling a setup that requires physical keys.

Checked when: Your spare is registered and reachable, or you have reviewed a different supported backup method.

1. Confirm that you still control each recovery number and can access each recovery inbox. Check old work, school, and provider addresses.
2. Add and verify a current replacement before removing an old method where possible. Follow the provider's waiting periods and confirmation steps.
3. Check recovery contacts, trusted devices, and official recovery instructions. Available options differ by service.

Checked when: Each priority account has current, verified recovery information and a known official recovery route.

1. Generate backup codes when offered and follow that service's storage instructions. A protected offline copy can avoid a device dependency.
2. Check whether codes are single-use and whether generating a new set invalidates the previous set.
3. Treat codes as secrets. Enter them only into the service's official recovery or sign-in flow, never in this checklist or a message to someone who contacts you.

Checked when: You know where the current codes are and can reach them without the missing device.

1. Trace the path for email, the password vault, and the account that syncs your passkeys: what does each require if your phone disappears?
2. Watch for email that needs the vault while the vault needs that same email, or backup codes stored only inside the locked account.
3. Keep an independently reachable method permitted by the provider. Walk through the instructions while still signed in; do not erase devices or remove your only working method to test them.

Checked when: You can describe a recovery route that does not rely solely on the unavailable device or account.

1. Use supported shared vaults, delegated access, or emergency-access features for information someone else genuinely needs.
2. Have the trusted person confirm they can use their own authorized access. Keep private accounts separate.
3. Check recovery-contact and legacy-contact rules. Helping someone recover an account and accessing it after their death are different permissions.

Checked when: A trusted person knows the plan and has tested the access you intend them to have.

1. Include computers, phones, browsers, apps, and your home router. Check whether older devices still receive security updates.
2. Remove software and browser extensions you no longer use. Keep a screen lock on devices that can open accounts.

Checked when: Your everyday devices are updated, with an update plan for anything still outstanding.

1. Use your carrier's official app or support channel to enable available account and port-out protections.
2. A SIM PIN locks use of the SIM; it is different from a carrier account PIN and does not stop a carrier-side SIM swap. Follow carrier instructions before changing it.
3. Prefer a non-SMS sign-in factor on important accounts when available.

Checked when: You have reviewed your carrier's protections and know which PIN protects which part of the account.

1. Review recent activity in your email, financial, cloud, and social accounts through their official settings.
2. Revoke access you no longer need. Investigate unfamiliar email-forwarding rules and sign-ins.
3. If you find evidence of compromise, follow the provider's compromised-account process; changing a password alone may leave other access in place.

Checked when: You recognize the access on priority accounts and have addressed unfamiliar activity.

1. Contact Equifax, Experian, and TransUnion separately through their official sites. A security freeze is free to place and lift.
2. Keep a way to manage each freeze when you apply for credit. A freeze limits access to your credit report; it does not protect existing accounts from every kind of fraud.

Checked when: You have reviewed all three bureaus and can manage any freezes you place.

1. An IP PIN helps prevent someone else from filing a federal tax return using your identifying information.
2. Keep it secure and follow IRS instructions for obtaining the current year's PIN and using it when filing.

Checked when: You have reviewed the IRS option and know how to retrieve the PIN if enrolled.

1. Use trusted dependency and secret scanners. Verify findings and fixes; an AI review is a lead, not proof that a project is secure.
2. Give tools only the repositories, credentials, and permissions their task requires. Review generated code and commands before applying them.
3. Use existing, narrowly scoped automation for recurring checks. Do not give a general-purpose agent unrestricted access just to run an audit.

Checked when: Your tools are supported, access is scoped, and security findings have been reviewed.

1. Agree on separate safewords offline with your trusted group. Do not reuse an account password, PIN, or recovery code.
2. For an urgent or unusual request, pause and call back using a number you already trust. Do not rely on a familiar voice or caller ID alone.
3. If the safewords are wrong, exposed, or forgotten, stop and verify another way. Knowing safewords does not automatically authorize a payment.

Checked when: Everyone knows the verification plan and has practiced a callback.

1. Choose a backup that will remain available if your everyday device is lost or damaged.
2. Restore a harmless sample file to a separate location and open it. Confirm that you can reach any encryption key or account needed for recovery.
3. Review the backup after replacing a device or changing accounts.

Checked when: A restored sample opens successfully, and you can reach the backup without the original device.

1. Keep emergency contacts and essential document copies in a secure place your household knows about. Keep secret recovery material protected separately.
2. Check water, shelf-stable food, needed medication, a flashlight, some cash, and a way to charge essential devices.
3. Use your local emergency-management guidance for supplies and safe backup power. Revisit the plan when your household changes.

Checked when: Someone else can find the offline plan and the essential supplies.