Checklist · Technology

Responding to a Data Breach: A First 72 Hours Checklist

Type: Checklist
Jurisdiction: National
Date: 2025-01-21
Topic: Technology

An operational, hour-by-hour checklist for the first three days of a data breach, written for the general counsel, the incident commander, and outside breach counsel who arrive after both. Twelve phases run from declaration and incident command through containment that does not destroy evidence, preservation and legal hold, the privilege architecture around the forensic engagement, insurance and law enforcement notification, the regulatory trigger inventory that starts a dozen incompatible clocks, data scoping and population building, the extortion and sanctions decision, public company materiality and Item 1.05, notification execution across fifty states and the sectoral regimes, vendor contract enforcement and recovery, and litigation readiness. Each phase carries commentary explaining the failure mode that phase exists to prevent and the traps that competent teams still fall into. A worked example follows a fictional health company through the sequence with specific dates, numbers, and decisions, including the one that made its aftermath survivable.

Responding to a Data Breach: A First 72 Hours Checklist

Technology > Cybersecurity | Published 21 January 2025 - Updated 3 July 2026 | UpLaw - uplaw.us

In brief. The technical investigation takes six weeks. The legal deadlines start in hours. Everything you do in the first three days will be produced, deposed, and read aloud — so do it in an order that assumes an audience.

Keywords: incident command, litigation hold, forensic preservation, privilege, panel consent, OFAC screening, materiality determination, 36-hour rule, HIPAA 60 days, state matrix, vendor notice trigger

How to use this. Phases 1–5 are the first six hours and they set the posture for everything else. Phases 6–9 are the first forty-eight hours and they are almost entirely legal. Phases 10–12 run past the seventy-two-hour mark into the notification and litigation window. Work them in order; the ordering is the point. The doctrine is in Cybersecurity and Data Breach Response: A Comprehensive Guide. The narrative is in The First 72 Hours: Why Breach Response Is a Legal Problem Before It Is a Technical One. The resource map is The Cybersecurity and Incident Response Toolkit.

A standing caution. No single deadline governs. The SEC gives four business days from a materiality determination; the federal banking agencies give 36 hours from a determination; NYDFS, CIRCIA, the NAIC model, and the GDPR give 72 hours; the FTC Safeguards Rule and several states give 30 days; HIPAA gives 60. They run from different triggering events and the strictest applicable one governs each population. Build the trigger inventory in Phase 6 before you think you have facts, not after.

Phase 1 — Hour Zero: Declaration, Command, and Counsel

[ ] Declare the incident under the response plan and record the declaration time, the declaring individual, and the severity level.
[ ] Name a single incident commander and a named alternate; record both.
[ ] Notify the general counsel immediately, regardless of severity, and record the time.
[ ] Engage outside breach counsel and get the engagement letter signed and dated today.
[ ] Notify the CEO and identify the board notification threshold and who will make that call.
[ ] Establish an out-of-band communication channel — assume email, chat, and the ticketing system are compromised.
[ ] Move incident coordination off the primary identity provider; use separately credentialed accounts.
[ ] Instruct the team, in writing, on written-communications discipline: facts and timestamps, no conclusions, no attribution, no speculation about fault.
[ ] Open a single dated fact log owned by one person, versioned, with a source for every entry.
[ ] Identify whether the company has public reporting obligations, regulated data, or regulated status, and flag each.
[ ] Confirm whether the incident response plan is accessible offline and whether call trees are current.
[ ] Set a cadence: standing calls at fixed times, with a written summary after each.

Why it matters, and the traps. The order of the first six calls determines the privilege posture, the evidence posture, and the credibility of every later filing. The recurring failure is a competent technical team that spends nine hours fixing before anyone calls a lawyer, generating an ordinary-course investigation that cannot later be re-characterized. The second failure is coordinating the response inside the environment the intruder controls, which has produced cases where the adversary read the negotiation strategy. Out-of-band is not theater.

Phase 2 — Containment Without Destroying the Evidence

[ ] Decide, explicitly, between isolate and monitor, and record the reasoning.
[ ] Take forensic images of affected hosts, domain controllers, and jump boxes before rebuilding anything.
[ ] Capture volatile data — memory, active connections, running processes — where it can still be captured.
[ ] Preserve firewall, VPN, EDR, DNS, proxy, and authentication logs and confirm retention windows before they roll.
[ ] Preserve email and file access audit logs, including mailbox audit and download telemetry.
[ ] Preserve cloud tenant logs — administrative activity, sign-in, and data-plane logs — which often have shorter retention than anyone believes.
[ ] Reset credentials on a planned sequence, starting with privileged accounts and service accounts, and record the sequence.
[ ] Enforce multi-factor authentication for remote access and administrative accounts if it is not already universal.
[ ] Verify backup integrity and isolation before relying on backups, and confirm they are not encrypted or deleted.
[ ] Document every containment action with who, what, when, and why.
[ ] Do not communicate with the threat actor without counsel and a documented decision.
[ ] Do not publicly attribute the attack, internally or externally, at this stage.

Why it matters, and the traps. Restoring service and preserving evidence pull in opposite directions, and business pressure wins by default. A company that re-images 340 servers to get lab results flowing has answered the operational question and permanently lost the ability to answer the legal one — how the intruder got in, what was accessed, and when. Cloud audit logs are the specific trap: default retention is frequently short, and the exfiltration evidence disappears in the middle of week two while everyone is busy.

Phase 3 — Preservation and Legal Hold

[ ] Issue a written litigation hold to custodians on day one; litigation is reasonably anticipated the moment you know.
[ ] Suspend automatic deletion: log rotation, backup expiry, chat retention, ticket purging, and voicemail.
[ ] Extend the hold to vendors and contractors with relevant data, in writing, and demand written acknowledgment.
[ ] Preserve the threat actor communications, leak site postings, and any samples published, with hashes and timestamps.
[ ] Preserve pre-incident materials: risk assessments, penetration test reports, remediation trackers, vulnerability scans, and prior audit findings.
[ ] Preserve the security program documentation that supports any safe harbor defense, with its original dates.
[ ] Identify custodians in security, IT, legal, finance, compliance, and the affected business units.
[ ] Log hold issuance, acknowledgments, and reminders; calendar re-issuance.
[ ] Confirm that remediation activity is documented separately from investigation activity.
[ ] Reconcile the hold with the evidence preservation steps in Phase 2 so nothing falls between them.

Why it matters, and the traps. Under Fed. R. Civ. P. 37(e), lost electronically stored information exposes a party to curative measures and, on a finding of intent to deprive, to an adverse inference or dismissal. Ransomware destroys evidence by design; automated retention destroys the rest. The most damaging omission is the pre-incident record — the penetration test that flagged the exact vector eighteen months earlier is discoverable whether you preserve it or not, and the company that "lost" it has converted a bad fact into a spoliation motion.

Phase 4 — Privilege Architecture and the Forensic Engagement

[ ] Have outside counsel — not the company — retain the forensic firm.
[ ] Execute a new statement of work whose scope differs from any pre-existing master services agreement with that firm.
[ ] State expressly that the engagement is in anticipation of litigation and regulatory proceedings to inform legal advice.
[ ] Address the deliverable to counsel; make it legal analysis, not a remediation roadmap.
[ ] Pay from the legal budget from the outset — do not reclassify later.
[ ] Stand up a separate operational track with a different vendor or a walled-off team for containment, restoration, and hardening, with its own reporting line.
[ ] Maintain a short, logged distribution list for privileged materials; no forwarding, no shared drives.
[ ] Mark privileged materials properly and train the team that marking a business document does not make it privileged.
[ ] Decide now what will be shared with regulators, the carrier, auditors, and customers — and what waiver that entails.
[ ] Consider whether to seek a Fed. R. Evid. 502(d) order early in any resulting litigation.
[ ] Brief the CISO and the incident commander that the underlying facts are not privileged and they will be deposed on them.

Why it matters, and the traps. In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. 2020), ordered production because the forensic firm would have done the same work under a pre-existing retainer regardless of litigation. Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021), rejected a two-track defense where only one track existed. In re Target, 2015 WL 6777384 (D. Minn. 2015), upheld the structure because both tracks were real. The lesson is structural, not cosmetic: the privileged investigation must be genuinely different from the one you would have run anyway.

Phase 5 — Insurance and Law Enforcement

[ ] Locate the cyber policy and read the notice provision, retention, sublimits, and consent requirements today.
[ ] Give notice to the carrier within the policy's deadline; late notice is a coverage defense.
[ ] Confirm whether counsel and the forensic firm are on panel, and obtain written consent if they are not.
[ ] Identify the retention, the waiting period for business interruption, and any contingent business interruption sublimit.
[ ] Confirm whether extortion payments require the carrier's prior consent and what the sublimit is.
[ ] Notify the D&O carrier if securities or derivative exposure is foreseeable.
[ ] Contact the FBI field office or Secret Service and file with IC3; record the agent, agency, and date.
[ ] Ask law enforcement, in writing, whether they request a delay in notification, and calendar a re-check.
[ ] Begin a cost accounting file from day one, coded for insurance recovery and for later cost quantification.
[ ] Preserve all invoices and engagement letters, which the carrier will audit.
[ ] Do not assume law enforcement engagement satisfies any notification obligation. It satisfies none.

Why it matters, and the traps. Retaining preferred counsel without panel consent is the single most common way companies forfeit millions in coverage on day one. The second trap is the law-enforcement delay: statutes permit deferral where an agency determines notice would impede an investigation, but an open-ended verbal comment from a field agent is not that determination. Get it in writing, note who gave it, and re-confirm on a calendar — a delay that outlives its justification is an unreasonable delay.

Phase 6 — The Regulatory Trigger Inventory

[ ] Build the trigger inventory: every regime that could apply, its trigger event, its clock, and its recipient.
[ ] Public company? Calendar the materiality determination and the four-business-day Item 1.05 clock.
[ ] Banking organization? Assess whether a notification incident has occurred; the 36-hour clock runs from determination.
[ ] Bank service provider? Assess the four-hour service-disruption notice duty to bank customers.
[ ] HIPAA covered entity or business associate? Fix the discovery date and calendar 60 days.
[ ] GLBA non-bank financial institution? Calendar the FTC's 30-day, 500-consumer notification event duty.
[ ] NYDFS covered entity? Calendar 72 hours, and 24 hours if any extortion payment is made.
[ ] CIRCIA covered entity? Confirm whether the implementing rule is effective today before relying on any answer.
[ ] Insurer, defense contractor, utility, pipeline, rail, telecom? Check the sectoral rule and its much shorter clock.
[ ] EU, UK, or other non-U.S. data subjects? Calendar GDPR Article 33 and any NIS2 or DORA duty.
[ ] Identify contractual notice obligations to customers, partners, and card networks — often 24 to 48 hours.
[ ] Assign one owner per clock, with a named backup, and put every clock on one shared calendar.

Why it matters, and the traps. The dominant failure in modern breach response is not missing a deadline nobody knew about; it is failing to notice that several unrelated clocks began at different moments on different facts. A company waiting for forensic certainty before starting any clock has usually missed three. Start the inventory when you know an incident occurred, populate it with what is known, and update it. The inventory is also the document that proves you were not sitting on the information.

Phase 7 — Scoping the Data and Building the Population

[ ] Identify what systems the intruder touched and what data those systems held — not what they were supposed to hold.
[ ] Determine whether there is evidence of exfiltration, access, or only presence, and be precise about which.
[ ] Run document review on exfiltrated data sets; do not infer content from file names or system labels.
[ ] Map data elements to the definition of personal information in each state, element by element.
[ ] Identify special categories that trigger additional duties: health, financial, biometric, credentials, minors' data.
[ ] Build the residency table — how many affected individuals in each state, territory, and country.
[ ] Apply each state's risk-of-harm off-ramp where available, and document the determination in writing.
[ ] Test the encryption safe harbor honestly: layer, key custody, plaintext exposure, and provable evidence.
[ ] Identify deceased individuals, minors, employees, and B2B contacts, each of which has different handling.
[ ] Resolve and de-duplicate the population; stale addresses drive the substitute-notice analysis.
[ ] Lock a version of the population with a date, and control changes to it.
[ ] Retain the vendor for notification and call center capacity now, before you need it.

Why it matters, and the traps. Population scoping is a legal analysis executed with data-science tools, and running it the other way around is how incidents get under-notified. The same record set is reportable in one state and not the next. The second trap is versioning: numbers change as review proceeds, and a company that quotes a figure to a regulator, a court, and the press on three different days from three different spreadsheets will spend a year explaining the discrepancies.

Phase 8 — The Extortion Decision and OFAC

[ ] Decide who has authority to authorize a payment, and confirm the board's role in advance.
[ ] Obtain the carrier's consent before any negotiation commits the company to anything.
[ ] Run OFAC screening: ransomware family, negotiator persona, wallet addresses, blockchain analytics, and intelligence vendors consulted.
[ ] Document the screening in a memorandum you would be willing to hand to a regulator.
[ ] Report to law enforcement and, where the analysis is close, consider an OFAC contact or license inquiry.
[ ] Confirm whether the entity moving the funds has its own FinCEN registration and reporting obligations.
[ ] Evaluate whether a decryptor is technically necessary or whether backups suffice, with a restoration time estimate.
[ ] Assume publication may occur regardless of payment, and plan the communications for that branch.
[ ] If payment is made, calendar the 24-hour reporting duties and any 30-day written explanation.
[ ] Record the reasoning for whichever decision is made, including the alternatives evaluated.
[ ] Confirm with counsel that payment extinguishes no notification obligation.

Why it matters, and the traps. OFAC's civil sanctions regime is strict liability: good faith, ignorance of the payee's identity, and business necessity are not defenses. The advisory's mitigating factors are self-initiated, timely, and complete reporting to law enforcement and a real sanctions compliance program — both of which must exist in the record. The other trap is the board that treats a $9 million ransom as cheaper than a $20 million response and does not hear, in the same meeting, that publication strengthens class plaintiffs' standing and that the data is gone either way.

Phase 9 — Public Company Disclosure and Materiality

[ ] Convene the disclosure committee; do not let the incident commander make the materiality call.
[ ] Assemble the facts known as of a stated date and time and record them.
[ ] Assess quantitative impact: revenue disruption, response cost, remediation, expected litigation and regulatory exposure.
[ ] Assess qualitative impact: data sensitivity, customer relationships, reputational harm, operational dependence.
[ ] Consider aggregation of related incidents that are individually immaterial.
[ ] Make and document the determination, with its date, or document the reasons it cannot yet be made.
[ ] If material, file Item 1.05 within four business days; if disclosing without a materiality determination, use Item 8.01.
[ ] Draft the 8-K to describe the nature, scope, and timing and the material or reasonably likely material impact — without operational detail that impedes response.
[ ] Review existing risk factors for statements describing as hypothetical a risk that has now occurred.
[ ] Review public security representations — the trust center, white papers, certifications, and RFP responses — against what is now known.
[ ] Impose a trading blackout and review any pending buyback or offering.
[ ] Calendar the Form 8-K/A amendment for information not determined at filing.

Why it matters, and the traps. The materiality determination must be made without unreasonable delay, and its timing is reconstructable from the fact log, the board calendar, and the emails. Two specific traps: filing under Item 1.05 while disclaiming materiality, which staff guidance discourages and which creates its own disclosure problem; and forgetting that pre-incident security statements are securities disclosures. SEC v. SolarWinds Corp., 741 F. Supp. 3d 37 (S.D.N.Y. 2024), sustained fraud claims on exactly that theory while dismissing most post-incident claims.

Phase 10 — Notification Execution

[ ] Build notices from the modular template: common core plus per-state inserts and per-state services offers.
[ ] Verify content requirements state by state — prescribed headings, prohibited content, freeze and police-report language.
[ ] Confirm the identity-theft services each state requires and for how long, and procure them.
[ ] Confirm the method: written notice by default, with electronic and substitute notice only where the statute permits.
[ ] File attorney general notices at each state's threshold, with the consumer notice attached where required.
[ ] File the HHS, FTC, regulator, or CISA reports on their own clocks, from the same fact set.
[ ] Provide media notice where required, and consumer reporting agency notice at the applicable thresholds.
[ ] Stand up a call center with a written script, escalation path, and daily reporting on question themes.
[ ] Publish a web page that matches the notices exactly, and keep it updated.
[ ] Brief customer-facing employees with an approved script; unscripted reassurance becomes a misrepresentation claim.
[ ] Reconcile the 8-K, the individual notices, the regulator reports, and the press statement line by line before anything goes out.
[ ] Plan for supplemental notice if the population or the data elements change.

Why it matters, and the traps. State attorneys general publish consumer notices; assume every notice is a press release and that the plaintiffs' bar reads them the day they post. The most consequential inconsistency in a breach matter is usually between two of the company's own communications — an 8-K that says "no evidence of exfiltration" and a notice three weeks later that says data was taken. One fact set, one owner, one reconciliation pass before release. Every time.

Phase 11 — Vendors, Contracts, and Recovery

[ ] Pull the contract with any vendor involved: notice trigger, cooperation, indemnity, liability cap, and insurance.
[ ] Send a written demand for forensic artifacts, logs, images, and the vendor's own investigation results.
[ ] Send a preservation demand and, if warranted, a notice of claim and an indemnity tender.
[ ] Determine whether the vendor's notice was timely under the contract and document the delay if it was not.
[ ] Tender to the vendor's insurer if the company is an additional insured.
[ ] Determine which party is the owner and which the maintainer for each affected data set, and who therefore notifies.
[ ] Coordinate messaging with the vendor; do not let the vendor notify your individuals.
[ ] Notify your own customers under the contractual notice provisions you owe them.
[ ] Assess whether the vendor should be suspended, replaced, or retained under conditions, and document the decision.
[ ] Inventory every other vendor with the same product or exposure, and require attestations.
[ ] Preserve the procurement and diligence file for the vendor — it will be evidence for both sides.

Why it matters, and the traps. A vendor breach is your breach for every clock, and you will run those clocks on facts the vendor controls and is slow to release, often because its own counsel is reviewing them for privilege. The clause that decides this is the notice trigger: a vendor obligated to notify on "confirmation" or "conclusion of investigation" is obligated to notify never. Fix that at renewal for every vendor in the portfolio; it costs nothing and it is worth more than the indemnity you negotiated instead.

Phase 12 — Litigation Readiness and the Post-Incident Record

[ ] Expect suit within days of the first public notice; pre-position defense counsel and a removal or remand strategy.
[ ] Evaluate the forum question deliberately: TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), does not bind state courts, and removal can be a trap.
[ ] Anticipate a books-and-records demand and confirm the board record shows cybersecurity reporting and oversight.
[ ] Prepare witnesses — the CISO, the incident commander, and the disclosure committee chair — on the facts, not the report.
[ ] Assess individual exposure and confirm indemnification, D&O insured status, and the need for separate counsel.
[ ] Assemble the safe harbor file: the written program, the named framework, and dated conformance evidence.
[ ] Complete remediation and document it — remediation is both mitigation and, unmanaged, an admission.
[ ] Conduct a lessons-learned review under privilege, with a clear scope and controlled distribution.
[ ] Update the incident response plan, the vendor contract template, and the state matrix.
[ ] Report the outcome to the board, in writing, and record the reporting.
[ ] Reconcile total costs against the insurance tower and pursue the claim on the policy's timetable.
[ ] Calendar regulator follow-up — attorneys general and sectoral regulators frequently open inquiries months later.

Why it matters, and the traps. The post-incident record is the record the company will be judged on for years, and remediation is where companies hurt themselves. A remediation plan that begins "implement multi-factor authentication on remote access" is an admission that MFA was absent, dated the week of the breach. That is not a reason to skip remediation; it is a reason to do the remediation before the incident and to describe the post-incident work in terms of enhancement rather than correction, accurately.

Worked Example

Meridian Harbor Health, Inc. (fictional), a Nasdaq-listed clinical laboratory and telehealth company in Columbus, Ohio, with patients in all fifty states. Entry was a zero-day in Calderwood Transit, a managed file transfer product from Calderwood Systems, LLC (fictional). The crew called itself Nightjar (fictional). Dwell time: February 3 to March 9. Exfiltration: 3.1 terabytes.

Monday, March 10. 5:12 a.m., a failed batch job. 5:31 a.m., ransom note found. 5:40 a.m., CISO Dana Okonkwo (fictional). 6:20 a.m., GC Renata Voss (fictional). 8:00 a.m., Brill & Aughton LLP (fictional) engaged; letter signed and dated that morning. 8:05 a.m., out-of-band channel opened. 9:00 a.m., litigation hold issued and log rotation suspended. 2:15 p.m., Ardent Forensics LLC (fictional) retained by counsel under a new statement of work; a second firm took restoration on a separate track. Images taken before any rebuild. Notice to Pemberton Casualty & Indemnity (fictional) at 4:40 p.m.; Ardent was off-panel and written consent was obtained the same day. FBI Columbus contacted; IC3 filed.

Tuesday, March 11. Trigger inventory built: HIPAA (2.34 million individuals, discovery dated March 10, 60 days to May 9); fifty-state matrix, with Colorado, Florida, Maine, and Washington at 30 days — April 9; Texas AG at 250 residents; California AG at 500. Meridian is not a bank, but Wexford Savings Bank (fictional) is, and Calderwood had not called it. Meridian's counsel told Calderwood, in writing, that its bank customers had 36-hour clocks. Wexford determined a notification incident at 9:00 a.m. Friday and notified its primary federal regulator by 9:00 p.m. Saturday. Larkspur Lending Corp. (fictional) calendared the FTC's 30-day Safeguards Rule report.

Wednesday, March 12. Nightjar demanded $9.4 million in Monero in 96 hours. Screening produced a plausible nexus to a designated persona; counsel could not clear it inside the deadline. The board declined to pay and the memorandum said why, including that publication would strengthen class plaintiffs' standing and that no notification duty would be extinguished by payment. The disclosure committee met at 3:00 p.m. and determined materiality, documenting the facts known at that hour.

Friday, March 14. Item 1.05 filed — within four business days of the March 12 determination. It described nature, scope, and timing, stated that the investigation was ongoing, and avoided any statement about exfiltration that the evidence did not yet support.

March 19. Nightjar published 40 gigabytes.

April 4. Document review closed the population at 2,341,600 individuals. Notices went out April 7 from a modular template: California headings and a twelve-month services offer; Massachusetts with the nature of the breach omitted and eighteen months of monitoring; Connecticut at twenty-four months. All fifty AG filings ran from the same fact set as the 8-K.

The aftermath. Twenty class actions consolidated as In re Meridian Harbor Health Data Security Litigation (fictional). Costs: $4.2 million forensics, $6.1 million notification and call center, $11.3 million credit monitoring, roughly $28 million business interruption, and $9 million in legal fees before class certification briefing — against a $50 million tower with a $2 million retention and an $8 million dispute over contingent business interruption. Plaintiffs moved to compel the Ardent report; the motion was denied on the strength of the separate scope, the separate restoration vendor, and the eleven-name distribution log. Meridian pleaded the Ohio safe harbor, Ohio Rev. Code §§ 1354.01–.05, supported by a written program naming the NIST Cybersecurity Framework and dated conformance evidence from the prior year.

What made it work: counsel engaged at 8:00 a.m. rather than day nine, a forensic engagement that was genuinely different from the one the company would have run anyway, images before rebuild, one dated fact set behind every external word, a fifty-state matrix built eighteen months earlier, and a sanctions memorandum written to be handed to a regulator rather than to justify a decision already made.

Responding to a Data Breach: A First 72 Hours Checklist

Phase 1 — Hour Zero: Declaration, Command, and Counsel

Phase 2 — Containment Without Destroying the Evidence

Phase 3 — Preservation and Legal Hold

Phase 4 — Privilege Architecture and the Forensic Engagement

Phase 5 — Insurance and Law Enforcement

Phase 6 — The Regulatory Trigger Inventory

Phase 7 — Scoping the Data and Building the Population

Phase 8 — The Extortion Decision and OFAC

Phase 9 — Public Company Disclosure and Materiality

Phase 10 — Notification Execution

Phase 11 — Vendors, Contracts, and Recovery

Phase 12 — Litigation Readiness and the Post-Incident Record

Worked Example

Related Documents