This guide covers cybersecurity incidents from preparation through litigation. It sets out the preparation that changes outcomes and explains why each item matters when an incident occurs. It walks the response hour by hour, with attention to the conflict between containment and evidence preservation and to the privilege structure that must be built before the forensic firm is engaged. It maps the notification stack: state statutes, sectoral federal rules, general unfairness authority, contract, and foreign law. It treats ransomware, insider incidents, vendor breaches, and payment card events as distinct problems. It covers regulatory enforcement and the standing doctrine that shapes private litigation. It closes with a governance program, a vendor management protocol, and a twelve-month calendar.