Toolkit · Technology

The Cybersecurity and Incident Response Toolkit

50 U.S.C. §§ 1701

Type
Toolkit
Jurisdiction
National
Date
2025-03-19
Topic
Technology

A research and resource map for cybersecurity law and data breach response, built for incident response counsel, privacy officers, and litigators. Ten pillars organize the field: the four overlapping regulatory regimes that apply to a single incident, the state breach notification statutes and the definitional variables that decide whether notice is owed at all, the healthcare and financial sector rules with their much shorter clocks, public company disclosure under the SEC cyber rules, CIRCIA and the federal reporting overlay, reasonable security obligations and the statutory safe harbors, incident response governance and the decisions that must be made before an incident, privilege over the forensic investigation after Capital One, ransomware and the sanctions exposure that attaches to paying, and litigation, standing, and insurance. Each pillar states the doctrine, names the controlling authorities, flags the trap and its second-order consequence, and points deeper. An authority shelf collects the statutes, regulations, leading cases, and standards. Two appendices supply a notification triage matrix keyed to data type and sector, and an hour-by-hour decision timeline for the first seventy-two hours.

The Cybersecurity and Incident Response Toolkit

Technology > Cybersecurity | Published 19 March 2025 - Updated 30 July 2026 | UpLaw - uplaw.us

In brief. A single incident triggers obligations under four independent regimes with different triggers, different clocks, and different definitions of the same words. The decisions that determine the outcome — who investigates, under whose direction, on what engagement letter — are made in the first six hours by people who are not lawyers. Make them in advance.

Keywords: state notification, risk of harm, HIPAA, GLBA Safeguards, Reg S-P, 36-hour rule, SEC Item 1.05, CIRCIA, FTC § 5, safe harbors, privilege, Capital One, ransomware, OFAC, TransUnion

How This Toolkit Is Organized

Ten pillars, each giving the doctrine, the anchors, the trap and its second order consequence, and where to go deeper. Then the authority shelf, then two appendices: a notification triage matrix and a first-72-hours decision timeline.

The narrative entry point is The First 72 Hours: Why Breach Response Is a Legal Problem Before It Is a Technical One. The doctrinal treatment is Cybersecurity and Data Breach Response: A Comprehensive Guide. The operational sequence is Responding to a Data Breach: A First 72 Hours Checklist.

Pillar 1 — Four Regimes, One Incident

Doctrine. Every material incident is simultaneously a state notification question, a sectoral regulatory question, a federal reporting question, and a contractual question. Each has its own trigger, clock, content requirement, and enforcer, and satisfying one satisfies none of the others.

Anchors. State breach notification statutes in all fifty states, the District of Columbia, and the territories. Sectoral rules: HIPAA, GLBA, Regulation S-P, the banking agencies' incident notification rule, state insurance data security laws. Federal: CIRCIA, SEC disclosure, DFARS 252.204-7012 for defense contractors. Contractual: customer agreements, data processing addenda, and PCI DSS.

Trap. Building the response around the state statutes because they are the most familiar. The sectoral clocks are far shorter — 36 hours for banking, 72 hours for CIRCIA and DFARS, four business days for an SEC Item 1.05 filing after a materiality determination — and they run while counsel is still counting affected residents.

Trap, second order. The contractual notice obligations, which almost nobody inventories in advance. Customer agreements routinely require notice "without undue delay" or within 24 or 48 hours of discovery, define "security incident" far more broadly than any statute, and carry indemnities. A company that satisfies every regulator and breaches its top ten customer contracts has managed the wrong risk.

Go deeper: Guide Part I

Pillar 2 — State Breach Notification

Doctrine. Notice is owed when defined personal information is subject to unauthorized acquisition or access, subject in most states to a risk of harm analysis and an encryption safe harbor.

Anchors. The fifty-plus state statutes; California's original statute, Cal. Civ. Code § 1798.82; Massachusetts 201 CMR 17.00; the state attorney general notification thresholds; consumer reporting agency notification requirements above defined counts.

Trap. Treating "personal information" as a single concept. The definitions diverge on whether they include usernames with credentials, biometric data, health and insurance information, taxpayer identification numbers, genetic data, and — in a growing set of states — data that would permit access to an online account. Run the definition state by state, because the answer determines whether notice is owed at all.

Trap, second order. The acquisition versus access distinction and the burden it carries. Some statutes trigger on unauthorized acquisition, others on unauthorized access, and several presume a breach unless the entity determines after investigation that harm is unlikely — with the determination documented and, in some states, filed with the attorney general. A company that concludes "no reasonable likelihood of harm" without a written analysis has made an unreviewable judgment that a regulator will review anyway.

Go deeper: Guide Parts II–III · Appendix A below

Pillar 3 — Healthcare

Doctrine. HIPAA presumes that an impermissible use or disclosure of unsecured protected health information is a breach unless a four-factor risk assessment demonstrates a low probability of compromise.

Anchors. Breach Notification Rule, 45 C.F.R. §§ 164.400–414 — the four factors (nature and extent of the PHI including identifiers and likelihood of re-identification; the unauthorized person who used or received it; whether the PHI was actually acquired or viewed; the extent to which risk has been mitigated). Security Rule, 45 C.F.R. Part 164 Subpart C. HITECH. Business associate agreements, § 164.504(e). FTC Health Breach Notification Rule, 16 C.F.R. Part 318, for health apps and vendors of personal health records outside HIPAA.

Trap. The presumption runs against the covered entity. Unlike most state statutes, HIPAA starts from breach and requires the entity to prove low probability of compromise across all four factors, in writing. "We found no evidence of exfiltration" is not the analysis.

Trap, second order. The 60-day clock runs from discovery by the covered entity, and a business associate's knowledge is imputed where the business associate is the entity's agent — so a vendor that sat on an incident for three weeks may have consumed half the covered entity's notification period before the covered entity heard about it. Fix this in the business associate agreement with a 24-hour vendor notice obligation, not by relying on the regulation.

Go deeper: Guide Part IV

Pillar 4 — Financial Services

Doctrine. Financial institutions face the shortest clocks in American breach response, and several are measured from determination rather than from investigation's end.

Anchors. GLBA Safeguards Rule, 16 C.F.R. Part 314 — a written information security program with a qualified individual, risk assessment, access controls, encryption, multifactor authentication, service provider oversight, incident response plan, and annual reporting to the board; plus notification to the FTC for events involving defined thresholds of consumer information. Regulation S-P, 17 C.F.R. § 248.30, as amended to require an incident response program and customer notification. The banking agencies' Computer-Security Incident Notification Rule — notification to the primary federal regulator within 36 hours of determining a notification incident has occurred. State insurance data security laws following the NAIC model. NYDFS Part 500 — 72-hour notice, annual certification, CISO reporting, and specific control requirements.

Trap. The 36-hour banking rule. It runs from the determination that a notification incident occurred, not from the completion of forensics, and the class of qualifying incidents includes material disruption of operations, not merely data compromise. Firms that treat it as a data-breach rule miss it on availability incidents.

Trap, second order. Bank service providers have their own obligation to notify each affected banking organization customer as soon as practicable after determining a material disruption has occurred or is reasonably likely to last four or more hours. A fintech that considers itself unregulated because it is not a bank frequently is a bank service provider, and its contracts say so.

Go deeper: Guide Part V · Consumer Financial Services Regulation: A Comprehensive Guide

Pillar 5 — Public Company Disclosure

Doctrine. A registrant must disclose a material cybersecurity incident on Form 8-K within four business days of determining materiality, and must describe its risk management, strategy, and governance annually.

Anchors. Form 8-K Item 1.05; Regulation S-K Item 106; the materiality standard of TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976), and Basic Inc. v. Levinson, 485 U.S. 224 (1988). The national security and public safety delay mechanism requiring Attorney General determination. Regulation FD; insider trading policy and trading windows.

Trap. The clock runs from the materiality determination, which must be made "without unreasonable delay" after discovery. A company cannot extend its four days by declining to decide, and a regulator reconstructing the timeline will ask when the company had enough information to decide.

Trap, second order. Item 8.01 versus Item 1.05. Registrants have voluntarily disclosed immaterial incidents under Item 8.01, and staff guidance has cautioned against blurring the two — an Item 1.05 filing signals materiality, and filing there defensively can create securities exposure of its own. Decide which item applies, document the reasoning, and note that insider trading controls must lock down before the disclosure decision, not after.

Go deeper: Guide Part VI

Pillar 6 — Reasonable Security and the Safe Harbors

Doctrine. There is no general federal data security statute; the obligation is assembled from FTC unfairness authority, sectoral rules, state reasonable-security statutes, and contract.

Anchors. FTC Act § 5; FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) (unfairness authority over data security confirmed); LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018) (order vacated as insufficiently specific — a lesson about remedial drafting, not about authority). State reasonable-security statutes; the safe harbor statutes in Ohio, Utah, Connecticut, and others conferring an affirmative defense for programs conforming to a recognized framework. NIST Cybersecurity Framework 2.0; NIST SP 800-53 and SP 800-171; CIS Controls; ISO/IEC 27001. PCI DSS as contract.

Trap. Assuming that because no statute prescribes controls, none are required. FTC consent orders, state AG settlements, and the safe harbor statutes have collectively defined a de facto baseline: multifactor authentication, encryption at rest and in transit, access control and least privilege, logging and monitoring, patch management, vendor diligence, and a tested incident response plan. Absence of any of these is what an enforcement narrative is built from.

Trap, second order. The safe harbors are affirmative defenses that must be pleaded and proved, and they require conformity to a named framework at a scale appropriate to the business — which means documented mapping, not aspiration. A company claiming NIST CSF alignment with no current assessment has a defense it cannot establish.

Go deeper: Guide Part VIII

Pillar 7 — Incident Response Governance

Doctrine. The quality of a response is determined by decisions made before the incident: who leads, who is retained, under what engagement, and what authority exists to take systems offline.

Anchors. GLBA Safeguards Rule and NYDFS Part 500 incident response plan requirements; NIST SP 800-61 (incident handling); SEC Item 106 governance disclosure; board oversight duties under In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), and Marchand v. Barnhill, 212 A.3d 805 (Del. 2019).

Trap. An incident response plan that names roles but does not grant authority — specifically, who may disconnect a production system, who may engage outside counsel without procurement, and who may authorize a payment. Response failures are usually escalation failures.

Trap, second order. Board oversight as a derivative exposure. Marchand and its progeny make failure to implement any reporting system for a mission-critical risk a basis for oversight liability, and public companies now describe their cyber governance in Item 106. A board that receives no cyber reporting, and says so in its own filings, has created the record for the claim.

Go deeper: Guide Part IX · Checklist Phase 1

Pillar 8 — Privilege Over the Forensic Investigation

Doctrine. A forensic report is privileged only if it was genuinely created because of anticipated litigation and at counsel's direction — not merely routed through counsel.

Anchors. In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. 2020) (report not privileged where the firm had a pre-existing vendor relationship, the scope of work was materially unchanged, and the report was widely distributed internally). In re Rutter's Inc. Data Security Breach Litigation (M.D. Pa. 2021). Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021) (endorsing a two-track structure). Fed. R. Civ. P. 26(b)(3).

Trap. Using the incumbent security vendor under the same statement of work, paid from the same budget, with the report distributed to business teams. That is the Capital One fact pattern precisely, and it produces a discoverable roadmap of every control failure.

Trap, second order. The two-track structure only works if it is real. Track one is the business remediation investigation, conducted by the incumbent vendor, expected to be discoverable. Track two is a separately retained firm, engaged by outside counsel on a new engagement letter, paid from the legal budget, reporting only to counsel, with distribution restricted and logged. Anything that blurs the tracks — one vendor, one report, one distribution list — collapses both.

Go deeper: Guide Part X

Pillar 9 — Ransomware, Extortion, and Sanctions

Doctrine. Paying an extortion demand is lawful in most circumstances and can constitute a sanctions violation on a strict liability basis if the recipient is a blocked person.

Anchors. OFAC advisories on the sanctions risks of facilitating ransomware payments — noting strict liability under the International Emergency Economic Powers Act, 50 U.S.C. §§ 1701–1708, and treating a report to law enforcement and full cooperation as a significant mitigating factor. FinCEN advisories and SAR obligations for financial institutions involved in payments. CIRCIA's 24-hour ransom payment reporting requirement. 18 U.S.C. § 1030 (CFAA); Van Buren v. United States, 593 U.S. 374 (2021).

Trap. Treating the payment decision as a business decision. It requires OFAC screening of the threat actor and the wallet, a documented sanctions analysis, an assessment of whether the incident response firm or insurer is acting as a money transmitter, and — increasingly — state statutes restricting payments by public entities.

Trap, second order. Reporting is the mitigation. OFAC treats a timely, complete report to law enforcement and full cooperation as significantly mitigating; a company that pays quietly and is later found to have paid a designated actor has forfeited the only defense available. Contact the FBI or Secret Service before the payment, not after.

Go deeper: Guide Part XI

Pillar 10 — Litigation, Standing, and Insurance

Doctrine. Breach litigation is a standing fight before it is a merits fight, and coverage is a separate contract dispute that frequently outlasts the underlying claims.

Anchors. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) (concrete injury; no standing for risk of future harm in a damages suit absent materialization); Clapper v. Amnesty International USA, 568 U.S. 398 (2013); Spokeo, Inc. v. Robins, 578 U.S. 330 (2016). Cal. Civ. Code § 1798.150 (CCPA private right of action for breach of nonencrypted, nonredacted personal information, with statutory damages and a cure provision). Negligence, implied contract, and state consumer protection theories. Cyber policy terms; the war exclusion litigation arising from destructive-malware losses; business interruption and contingent business interruption; dependent-system failure.

Trap. The CCPA statutory damages claim, which avoids the TransUnion problem entirely by supplying a statutory injury and a per-consumer damages range — converting a case that would fail on standing into one with a computable exposure the moment California residents are affected.

Trap, second order. Cyber insurance notice and consent. Policies are claims-made, require notice of a "security incident" on short timelines, and condition coverage on the insurer's prior consent to retain counsel and forensic vendors and to make an extortion payment. A company that engages its preferred firm and pays a ransom before calling the carrier may have a covered event and no coverage. Call the carrier in the first hours, and negotiate panel-counsel flexibility at renewal rather than during an incident.

Go deeper: Guide Parts XIII–XIV · Insurance Coverage Disputes: A Comprehensive Guide

The Authority Shelf

Federal statutes

Regulations and rules

  • 45 C.F.R. §§ 164.400–414 (HIPAA Breach Notification); 45 C.F.R. Part 164 Subpart C (Security Rule)
  • 16 C.F.R. Part 314 (GLBA Safeguards); 16 C.F.R. Part 318 (Health Breach Notification)
  • 17 C.F.R. § 248.30 (Regulation S-P)
  • Banking agencies' Computer-Security Incident Notification Rule (36-hour)
  • Form 8-K Item 1.05; Regulation S-K Item 106
  • DFARS 252.204-7012; the FAR CUI rule; CMMC
  • 23 NYCRR Part 500 (NYDFS)
  • State breach notification statutes and state reasonable-security and safe harbor statutes

Leading cases

  • TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976) · Basic Inc. v. Levinson, 485 U.S. 224 (1988) · In re Caremark Int'l Inc. Derivative Litig., 698 A.2d 959 (Del. Ch. 1996) · Clapper v. Amnesty Int'l USA, 568 U.S. 398 (2013) · FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) · Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) · LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018) · Marchand v. Barnhill, 212 A.3d 805 (Del. 2019) · In re Capital One Consumer Data Sec. Breach Litig., 2020 WL 2731238 (E.D. Va. 2020) · Van Buren v. United States, 593 U.S. 374 (2021) · Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021) · TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)

Standards and official guidance

  • NIST Cybersecurity Framework 2.0; NIST SP 800-61 (Computer Security Incident Handling Guide); SP 800-53; SP 800-171
  • CIS Critical Security Controls; ISO/IEC 27001 and 27035; PCI DSS
  • CISA advisories and the #StopRansomware guide; FBI IC3 reporting
  • OFAC ransomware advisories; FinCEN ransomware advisories and SAR filing instructions
  • HHS Office for Civil Rights breach portal and resolution agreements — the best available account of what enforcement actually targets
  • FTC data security consent orders and business guidance
  • State attorney general breach report portals and annual breach reports

Secondary sources

  • Data Security and Privacy Law (Thomson Reuters) — the standard practitioner treatise
  • Daniel J. Solove & Paul M. Schwartz, Information Privacy Law — the leading casebook
  • Solove & Woodrow Hartzog, Breached! Why Data Security Law Fails and How to Improve It
  • IAPP resource center and the Journal of Data Protection & Privacy
  • Sedona Conference commentaries on incident response and privilege
  • Verizon Data Breach Investigations Report — the empirical baseline for what actually causes incidents

Appendix A — Notification Triage Matrix

Run every row against every incident. The answer to "do we notify" is almost never a single answer.

If the compromised data includes… Then evaluate Clock
Name + SSN, driver's license, financial account, or state-defined identifier State breach notification in every state of residence 30–90 days; several states impose "most expedient time and without unreasonable delay"
Username or email with password or security question Several states' expanded definitions; credential-specific notice content Same
Protected health information held by a covered entity or business associate HIPAA four-factor risk assessment; presumption of breach 60 days from discovery; 500+ residents also requires media notice and contemporaneous HHS notice
Health data held by a non-HIPAA app or PHR vendor FTC Health Breach Notification Rule 60 days; FTC notice
Customer information at a financial institution GLBA Safeguards Rule; FTC notification thresholds 30 days to FTC for qualifying events
Customer information at a broker-dealer or adviser Regulation S-P incident response and customer notice As specified by the amended rule
Any incident materially disrupting a banking organization Banking agencies' rule 36 hours from determination
Bank service provider disruption ≥ 4 hours Notice to each affected banking organization customer As soon as practicable
Incident at a covered critical infrastructure entity CIRCIA substantial cyber incident report 72 hours; 24 hours for a ransom payment
Any incident at a public company Materiality determination; Form 8-K Item 1.05 4 business days from materiality determination
Controlled unclassified information at a defense contractor DFARS 252.204-7012 72 hours to DoD
New York financial services licensee NYDFS Part 500 72 hours
Payment card data PCI DSS and card brand rules; acquirer notice Contractual, typically immediate
Data of EU/UK data subjects GDPR Article 33 supervisory authority notice 72 hours
Data covered by a customer contract Contractual notice — often broader and faster than any statute Frequently 24–48 hours from discovery

Appendix B — First 72 Hours Decision Timeline

When Decision (and who owns it)
Hour 0–1 Confirm the incident is real. Escalate to the named incident lead. Do not begin remediation that destroys evidence.
Hour 1–2 Engage outside counsel. Every subsequent retention flows through counsel or the privilege argument is gone.
Hour 2–4 Retain the forensic firm on a new engagement letter from counsel, from the legal budget, reporting only to counsel — the second of the two tracks. Keep the incumbent vendor on the business track.
Hour 2–4 Notify the cyber carrier. Consent to counsel and vendors is a coverage condition.
Hour 4–8 Issue a litigation hold. Preserve logs, images, and ephemeral messaging before retention policies delete them.
Hour 4–8 Contain. Record every containment action and its time — the timeline is the central exhibit in every later proceeding.
Hour 8–24 Begin the data-type inventory: what categories, whose, in which states and countries. This drives every clock in Appendix A.
Hour 8–24 Screen the threat actor against OFAC if extortion is involved. Contact the FBI or Secret Service before any payment.
Hour 12–24 Assess the 36-hour banking and 72-hour CIRCIA / DFARS / NYDFS / GDPR triggers. These expire first.
Hour 24–48 Make the materiality determination if a public company, and lock insider trading windows now.
Hour 24–48 Inventory contractual notice obligations across major customers and vendors.
Hour 24–72 Draft the HIPAA four-factor analysis, or the state risk-of-harm analysis, in writing — regulators will read it.
Hour 48–72 File the short-clock regulatory reports. Prepare notification content per state content requirements.
Hour 48–72 Prepare external communications; confirm they are consistent with what the forensic record will support. Overstating containment early is the single most common source of later securities and consumer claims.
Ongoing Track every notification deadline on a single calendar with a named owner per jurisdiction.

Related Documents

Articles

Guides

Checklists

Toolkits