Start with scope. One device, one room, or everyone? One device points to the endpoint, its adapter, its address or its account. One room points to an access point, a switch port or a cable run. Everyone points to the router, firewall, or ISP.
Then walk the chain outward. Does the device have a valid address and gateway? Can it ping the gateway? Can it ping a public IP (Internet Protocol) address? Can it resolve a name? Can it load a site? The first step that fails names the layer, and the layers map exactly to fixes: cable/port/VLAN (Virtual Local Area Network), DHCP (Dynamic Host Configuration Protocol), routing/firewall, DNS (Domain Name System), application.
Check the physical layer honestly. Link lights, the actual cable, whether the ONT shows fault, and whether the router has been power-cycled by a cleaner. In a real office, someone unplugging a switch to charge a phone accounts for more outages than any protocol failure.
Finally, confirm with the ISP only when your evidence supports it — the modem has no sync, or the router's WAN (Wide Area Network) interface has no public address. Calling the ISP first, with no evidence, costs an hour on hold and teaches the client nothing.