Running the First Seventy-Two Hours of a Security Incident: A Practical Checklist

Technology > Cybersecurity Incidents and Breach Response | Published 26 July 2025 - Updated 18 November 2025 | UpLaw - uplaw.us

Part A — Hours 0 to 2

A1. Record and Assemble

• [ ] Record the time and source of the first indication, verbatim.
• [ ] Declare an incident and assign the severity tier.
• [ ] Name the incident commander for this incident, and the backup.
• [ ] Open a decision log: time, decision, who made it, basis. Maintain it throughout.
• [ ] Open a single communication channel for the response team, and keep it off any system that may be compromised.

A2. Contain Without Destroying

⚠️ The most damaging hour-one action is usually well-intentioned remediation.

• [ ] Isolate, do not power off. Pull network connectivity; do not shut down.
• [ ] Capture volatile memory before any shutdown, where capability exists.
• [ ] Image affected systems before remediating them.
• [ ] Snapshot cloud resources; do not terminate instances.
• [ ] Disable compromised accounts; reset credentials and revoke sessions and tokens.
• [ ] Block known malicious outbound destinations at the perimeter.
• [ ] Do not reimage, wipe, restore over, or decommission anything in scope.
• [ ] Preserve logs now — endpoint, network, authentication, application, cloud audit, and email audit logs, which frequently have the shortest retention.

A3. Preservation Hold

• [ ] Issue in writing within the first hours, to everyone who could touch relevant data.
• [ ] Scope: systems, accounts, mailboxes, date range — broad at first.
• [ ] Suspend routine deletion, rotation, and archival policies.
• [ ] Include chat, ticketing, bridge recordings, and personal devices used for work.
• [ ] Extend to vendors in writing, invoking the contract.
• [ ] Require acknowledgment.

A4. Engage, in This Order

• [ ] Counsel first. The investigation must be structured for privilege from the beginning.
• [ ] Counsel engages the forensic firm — separate engagement letter, stating the legal purpose, report addressed to counsel.
• [ ] Notify the cyber insurer per policy terms; confirm panel requirements and obtain consents before retaining anyone.
• [ ] Brief executive leadership, distinguishing what is known from what is assumed.
• [ ] Activate communications. Nobody else speaks externally.
• [ ] Consider law enforcement, on counsel's advice.

A5. Protect Privilege

• [ ] Forensic engagement letter states the purpose is to enable legal advice.
• [ ] Report addressed and delivered to counsel.
• [ ] Distribution controlled and logged. Broad circulation is how privilege is most often lost.
• [ ] Operational remediation documented separately from the legal investigation.
• [ ] Invoices route through counsel.
• [ ] Label accurately — do not mark everything privileged.
• [ ] Write every document as though an adversary will read it.

Part B — Hours 2 to 72: Scoping

Six questions determine every downstream obligation.

• [ ] 1. What systems were accessed?
• [ ] 2. Was data acquired, or merely accessible? Most statutes turn on unauthorized acquisition.
• [ ] 3. Which data elements? Name alone rarely triggers notification; name plus account numbers, government identifiers, medical information, biometric data, or credentials usually does.
• [ ] 4. Which individuals, and where do they reside? Residence determines the governing statute.
• [ ] 5. What is the time window? Dwell time bounds what must be assumed.
• [ ] 6. Is the attacker out? Do not notify while access persists.

Supporting Work

• [ ] Enumerate mailbox or file share contents for regulated data where a repository was accessed. This is the expensive part and it drives the timeline.
• [ ] Check for lateral movement. The first compromised account is usually a beachhead.
• [ ] Identify affected vendors and customers, and whose data is whose.
• [ ] Confirm log coverage and retention at every layer; note gaps explicitly, because gaps become assumptions.
• [ ] Verify encryption state for any lost or stolen device from management console records, before any remote wipe.
• [ ] Document what could not be determined, and why.

Part C — The Notification Analysis

Build the deadline table before drafting anything.

C1. Identify Every Applicable Regime

• [ ] State breach notification statutes for every state of residence represented in the affected population. Note for each: the definition of personal information, whether the trigger is access or acquisition, whether a risk-of-harm analysis is available, the outside deadline, attorney general thresholds, consumer reporting agency thresholds, and content requirements.
• [ ] State privacy statutes, including any private right of action for breaches caused by unreasonable security.
• [ ] Health information — 42 U.S.C. § 1320d and 45 C.F.R. part 164: sixty days for individual notice, notice to the Secretary, media notice at 500 or more residents of a state or jurisdiction, and the four-factor risk assessment. Related provisions at 45 C.F.R. part 160 and 45 C.F.R. part 162; criminal exposure at 42 U.S.C. § 1320d-6.
• [ ] Financial institutions — 15 U.S.C. § 6801, 15 U.S.C. § 6802, and 16 C.F.R. part 314, plus any banking regulator's shorter incident report.
• [ ] Consumer report data — 15 U.S.C. § 1681a, disposal duties at 15 U.S.C. § 1681w, furnisher duties at 15 U.S.C. § 1681s-2, red flags at 16 C.F.R. part 681.
• [ ] Children's data — 16 C.F.R. part 312.
• [ ] Health apps outside the health framework — 16 C.F.R. part 318.
• [ ] Public company disclosure — materiality determination without unreasonable delay, then disclosure on the prescribed timeline, under 15 U.S.C. § 78m and 17 C.F.R. part 240.
• [ ] General unfairness exposure under 15 U.S.C. § 45, which is not a notification duty but shapes everything you say.
• [ ] Contracts — customer agreements, business associate agreements, payment card rules, vendor terms. Usually the shortest deadlines.
• [ ] Foreign regimes for any non-United States individuals.

C2. Build the Deadline Table

Obligation	Trigger date	Deadline	Owner	Status

• [ ] Identify the single shortest deadline and work backward from it.
• [ ] Confirm the sequence — some regimes require regulator notice first or simultaneously.
• [ ] Assign a named owner to each obligation. The most common failure is two people each assuming the other owns it.

C3. If Notification Is Not Required

• [ ] Write the determination memorandum: what was determined, when, the analysis, and the conclusion.
• [ ] Include the risk-of-harm analysis in the form the applicable statute contemplates.
• [ ] Date it, and retain it. A regulator asking in two years will be answered by this document or by nothing.

Part D — If It Is Ransomware

• [ ] Assess both dimensions: encryption (availability) and exfiltration (breach). Most current operations exfiltrate first.
• [ ] Assess backups immediately: intact, offline, and tested? This determines leverage.
• [ ] Do not communicate with the threat actor without counsel and, where retained, a specialist negotiator.
• [ ] Sanctions screening before any payment discussion.
• [ ] Obtain insurer consent before any payment.
• [ ] Understand what payment does not do: it does not guarantee a working decryptor, does not guarantee deletion, and does not eliminate notification obligations.
• [ ] Escalate the payment decision to executives, informed by counsel. It is not a technical decision.
• [ ] Plan for the follow-on: publication of partial data, direct contact with customers and individuals, and repeat targeting.
• [ ] Base the notification analysis on the exfiltration facts, not on whether files were unlocked.
• [ ] Preserve the ransom note, all communications, and the wallet or payment details.

Part E — The Notice Documents

E1. Individual Notice

• [ ] What happened, in the first two sentences, with dates.
• [ ] What information was involved — for this recipient, not every category in the incident.
• [ ] What we are doing: containment, investigation, controls added, law enforcement involvement.
• [ ] What you can do: fraud alerts, security freezes, statement monitoring, password changes.
• [ ] What we are offering: enrollment mechanics, code, deadline, and duration.
• [ ] Where to get help: a staffed number with hours, and a monitored email address.
• [ ] State-specific inserts where statutes prescribe headings, font, or required language.
• [ ] Tone check: direct, specific, unhedged. Do not open with a privacy commitment. Do not use passive voice for the intrusion.
• [ ] Accuracy check: do not send anything you may have to correct.

E2. Regulator Notice

• [ ] Factual chronology with dates.
• [ ] Data categories and volumes; number of affected residents of that state.
• [ ] Cause and vector.
• [ ] Remediation with dates.
• [ ] Individual notice attached as an exhibit.
• [ ] Prescribed form and portal, where applicable.

E3. Media and Substitute Notice

• [ ] Media notice where required — including large health breaches under 45 C.F.R. part 164.
• [ ] Substitute notice only where the statutory conditions are met; verify each state's thresholds.
• [ ] Coordinate all versions so they do not diverge.

E4. Operations

• [ ] Call center stood up with a script, trained staff, and an escalation path.
• [ ] Credit monitoring or identity protection procured, with enrollment tested end to end.
• [ ] Website posting live before notices land.
• [ ] Internal briefing so employees do not learn about it from customers.
• [ ] Enterprise customer outreach coordinated with their own notification clauses.

Part F — Insider Incidents

• [ ] Preserve before confronting. Image the device and collect logs before any conversation.
• [ ] Do not reimage a departing employee's laptop. The most common irreversible mistake in insider matters.
• [ ] Preserve email, chat, file access logs, badge records, and cloud storage activity.
• [ ] Analyze the access question correctly. Under Van Buren v. United States, 141 S. Ct. 1648, "exceeds authorized access" in 18 U.S.C. § 1030 reaches obtaining information from areas one is not entitled to access at all — misuse by an authorized user is a trade secret and contract problem instead.
• [ ] Coordinate employment, security, and breach counsel so statements are consistent.
• [ ] Run the notification analysis independently. An insider exfiltration triggers the same statutes.
• [ ] Consider preservation and injunctive relief where data left with a person.

Part G — Vendor Incidents

• [ ] Invoke cooperation and audit clauses in writing the same day.
• [ ] Ask five specific questions: what was accessed; over what window; whether your data was exfiltrated; what logs exist and for how long; what other customers were told.
• [ ] Start your own scoping in parallel. Your clock runs from your discovery.
• [ ] Notify your insurer.
• [ ] Prohibit the vendor from notifying your customers without consent, if the contract allows.
• [ ] Preserve the vendor's notices and your requests — the record supports both the regulator narrative and the indemnity claim.
• [ ] Determine who notifies individuals. Generally the entity with the relationship to them.
• [ ] Check whether detailed cloud audit logging was ever enabled. It is frequently an optional paid tier.

Part H — After the Notice

• [ ] Close the vector, not just the symptom.
• [ ] Implement the identified control improvements, with dates recorded.
• [ ] Respond to regulator inquiries, which arrive in clusters with overlapping questions; maintain one consistent factual chronology.
• [ ] Preserve everything for litigation, which is likely.
• [ ] Track standing developments — TransUnion LLC v. Ramirez, 594 U.S. 413, Spokeo, Inc. v. Robins, 578 U.S. 330, and Clapper v. Amnesty International USA, 568 U.S. 398 shape the first motions.
• [ ] Pursue insurance recovery and vendor indemnity.
• [ ] Conduct an after-action review within thirty days.
• [ ] Update the incident response plan with what was learned.
• [ ] Report to the board, including what changed.

Part I — After-Action Review Agenda

• [ ] Timeline reconstruction: compromise, detection, containment, notification. Compute the intervals.
• [ ] How was it detected? Internal monitoring, or a third party? If a third party, why?
• [ ] What evidence was lost, and why?
• [ ] Was the preservation hold issued in time and to the right people?
• [ ] Was privilege preserved? If not, at what step did it fail?
• [ ] Which deadline was tightest, and was it met?
• [ ] What did the notice have to say that we wished it did not?
• [ ] What control would have prevented this? Name one.
• [ ] What control would have contained it faster? Name one.
• [ ] What logging gap made scoping harder?
• [ ] Which vendor terms failed us?
• [ ] Assign owners and dates to every action item, and review them in ninety days.

Part J — Actions That Make It Worse

• [ ] Wiping, reimaging, or restoring over a compromised system before imaging it.
• [ ] Powering off a system before capturing memory.
• [ ] Letting logs roll while deciding what to do.
• [ ] Engaging forensics directly, outside counsel, under an existing information technology agreement.
• [ ] Circulating the forensic report widely.
• [ ] Notifying before scoping is complete, producing a notice that must be corrected.
• [ ] Making an unverified statement to a regulator, a customer, or the press — with 18 U.S.C. § 1001 exposure attached.
• [ ] Deleting or altering records after an incident, implicating 18 U.S.C. § 1519.
• [ ] Retaining a non-panel vendor without insurer consent.
• [ ] Communicating with a threat actor without counsel.
• [ ] Assuming encryption applies without proving it from records.
• [ ] Letting a vendor's timeline drive your statutory clock.
• [ ] Failing to name an owner for the notification decision.

Part K — Hour-by-Hour Card

Print this and put it in the incident binder.

Time	Action	Owner
0:00	Record first indication; open decision log	Whoever received it
0:10	Declare incident; name commander	Commander
0:20	Isolate — do not power off, wipe, or restore	Security lead
0:30	Capture memory; begin imaging; freeze log rotation	Security lead
0:45	Call counsel	Commander
1:00	Counsel engages forensics; insurer notified	Counsel
1:30	Preservation hold issued in writing	Counsel
2:00	Executive brief: known, unknown, next checkpoint	Commander
4:00	Preliminary scope: which systems, which accounts	Forensics
8:00	Confirm attacker access is severed or contained	Forensics
12:00	Log coverage assessment; identify gaps explicitly	Forensics
24:00	Preliminary data-element assessment	Counsel + forensics
24:00	Contractual deadline inventory	Counsel
48:00	Affected-population estimate by state	Counsel
72:00	Deadline table complete with named owners	Counsel
72:00	Decision: notify, do not notify, or continue scoping	Named owner

⭐ The two entries that matter most are 0:20 and 0:45. Isolating instead of wiping preserves the ability to answer every later question, and calling counsel before forensics preserves the privilege structure. Both are free.

Part L — Communications Discipline

• [ ] One spokesperson. Everyone else declines and refers.
• [ ] Holding statement approved by counsel before any inquiry arrives.
• [ ] Say only what is verified. "We are investigating" is a complete answer in the first days.
• [ ] Never speculate about attribution, scope, or numbers.
• [ ] Never say "no evidence of misuse" without stating what was examined.
• [ ] Brief employees before customers hear it, with a script for what they may and may not say.
• [ ] Coordinate with enterprise customers individually; they have their own obligations and their own regulators.
• [ ] Assume every internal message will be produced. Write accordingly, including in chat.
• [ ] Do not use compromised systems to discuss the incident.
• [ ] Log every external statement with date, audience, and approver.

Part M — Evidence Inventory

Track what exists, where it is, and how long it survives.

Source	Retention	Preserved?	Where stored	Notes
Endpoint detection telemetry
Firewall / network flow logs
Authentication logs
Email audit logs				Shortest retention; preserve first
Cloud audit logs				Often an optional paid tier
Application logs
Database access logs				Answers the acquisition question
Backup catalogs
Disk images
Memory captures
Ransom note and communications
Physical access / badge records
Ticketing and chat records				Frequently forgotten

• [ ] Note every gap explicitly. A gap becomes an assumption, and assumptions become notifications.
• [ ] Record chain of custody for every image and export.
• [ ] Store preserved evidence outside the affected environment.

Part N — Readiness Check, Run Quarterly

Ten minutes. If any box is unchecked, that is the next project.

• [ ] Multifactor authentication is on for email, remote access, and administrative accounts, with a written exception list.
• [ ] Backups are offline and a restoration was successfully tested in the past twelve months.
• [ ] Log retention is at least ninety days at every layer, including cloud and email audit logs.
• [ ] The incident commander and backup are named, currently employed, and know it.
• [ ] After-hours contacts for counsel, forensics, and the insurer are current and have been dialed in the past year.
• [ ] Counsel and a forensic firm are pre-engaged, and both are on the insurer's panel.
• [ ] The cyber policy has been read for notice timing, panel requirements, consent provisions, and sublimits.
• [ ] A data map exists and was refreshed in the past year.
• [ ] The vendor inventory identifies who holds regulated data, with contract terms noted.
• [ ] Notice templates and holding statements are drafted and reviewed.
• [ ] A tabletop exercise was run in the past twelve months and its action items are closed.
• [ ] The preservation hold template exists and someone knows where it is.

Related Documents

• The First Six Hours: What Actually Happens After a Data Breach
• Cybersecurity Incidents and Breach Response: A Comprehensive Guide to Notification, Regulators, and Liability
• The Incident Response and Breach Notification Toolkit
• Cybersecurity and Data Breach Response: A Comprehensive Guide
• Data Breach Notification Law: A Comprehensive Guide
• The Cybersecurity and Incident Response Toolkit
• Responding to a Data Breach: A First 72 Hours Checklist
• Responding to a Data Breach: A Notification and Incident Response Checklist
• Data Privacy and Security: A Comprehensive Guide to Collection, Consent, Breach Response, and Enforcement
• Building a Privacy Compliance Program: A Practical Checklist
• The Data Privacy and Breach Response Toolkit
• Health Information Privacy: A Comprehensive Guide to HIPAA, Access Rights, and Breach Notification
• The HIPAA Compliance and Breach Response Toolkit
• Protecting Trade Secrets During a Data Breach: Building IP Into Incident Response