Toolkit · Technology

The Incident Response and Breach Notification Toolkit

42 U.S.C. § 1320

Type
Toolkit
Jurisdiction
National
Date
2025-02-25
Topic
Technology

This toolkit supplies the documents an organization needs during and around a security incident. It opens with the preservation hold and the counsel-directed forensic engagement, the two documents that decide whether evidence survives and whether the report is privileged. It provides a deadline tracker, a scoping worksheet, and a determination memorandum for the case where notification is not required. It includes individual and regulator notice templates, a call center script, and a holding statement. It supplies a ransomware decision matrix, vendor security contract clauses, a tabletop exercise script, and an after-action review template. Each tool names the specific failure it prevents.

The Incident Response and Breach Notification Toolkit

Technology > Cybersecurity Incidents and Breach Response | Published 25 February 2025 - Updated 21 February 2026 | UpLaw - uplaw.us

Before You Use Anything Here

Two documents decide most outcomes and both are written in the first two hours: the preservation hold (Tool 1) and the counsel-directed forensic engagement (Tool 2). Everything else is downstream.

Framework throughout: state notification statutes; health rules at 45 C.F.R. part 164 under 42 U.S.C. § 1320d; financial safeguards at 16 C.F.R. part 314 under 15 U.S.C. § 6801; general unfairness authority at 15 U.S.C. § 45.

Tool 1 — Preservation Hold

Issue within hours, in writing, to everyone who could touch relevant data.

PRESERVATION NOTICE — IMMEDIATE ACTION REQUIRED From: [General Counsel] | Date/Time: [ ] | Acknowledgment required by: [ ]

[Company] is investigating a potential security incident. You must preserve all potentially relevant information immediately.

1. Scope. All data relating to [systems], [accounts/mailboxes], for the period [date] to present, including: system and application logs; authentication logs; email and email audit logs; network flow and firewall logs; cloud audit logs; endpoint telemetry; database access logs; backup catalogs; ticketing records; chat messages; incident bridge recordings; and physical access records.

2. Suspend immediately. All routine deletion, log rotation, archival, overwrite, and retention-based purge policies applicable to the scope above. If a scheduled job would delete or overwrite in-scope data, disable it now and confirm to [name].

3. Do not. Do not reimage, wipe, restore over, decommission, or power off any in-scope system. Do not terminate cloud instances; snapshot them. Do not delete email, chats, or tickets. Do not remotely wipe any device without written authorization from [name].

4. Personal devices. If you used a personal device or account for work relating to the scope, preserve it and contact [name].

5. Vendors. If you manage a vendor relationship within the scope, forward this notice to them today and confirm receipt.

6. Questions. [Name, phone, email]. When in doubt, preserve.

7. Confidentiality. This notice is issued at the direction of counsel in anticipation of litigation. Do not forward outside the recipients listed without counsel's approval.

Acknowledge receipt by replying to this message.

Failure it prevents. Logs rolling and systems being rebuilt while the organization decides what to do — which converts a scoped incident into a full-population notification.

Tool 2 — Forensic Engagement Through Counsel

[Law Firm letterhead] [Date] [Forensic Firm] Re: Engagement to assist counsel — [Client] incident of [date]

Dear [Firm]:

[Law Firm] represents [Client] in connection with a potential security incident. We are engaging you to assist us in providing legal advice to [Client] regarding its legal obligations and potential liability arising from that incident, including obligations under state breach notification statutes, 42 U.S.C. § 1320d and 45 C.F.R. part 164 where applicable, 15 U.S.C. § 6801 and 16 C.F.R. part 314 where applicable, and 15 U.S.C. § 45.

1. Purpose. Your work is performed at our direction, for the purpose of enabling us to render legal advice, and in anticipation of litigation and regulatory proceedings.

2. Scope. [Describe the specific investigative tasks.] Your work under this engagement is separate from any operational remediation services [Client] obtains, whether from you under a separate agreement or otherwise.

3. Deliverables. All reports, drafts, findings, and communications are to be addressed and delivered to [Law Firm]. You will not distribute any deliverable to [Client] personnel or third parties without our written direction.

4. Confidentiality. Mark deliverables as prepared at the direction of counsel, privileged, and work product.

5. Invoices. Address invoices to [Law Firm].

6. Insurance. [Client]'s carrier is [ ] and this engagement is [is not] subject to panel approval, which has been [obtained on date / is pending].

Very truly yours, [Counsel]

Failure it prevents. The report that describes prior unremediated findings becoming Exhibit A in the class action.

Tool 3 — Scoping Worksheet

Question Answer Evidence source Confidence Gaps
Which systems were accessed?
Initial access vector
First compromise date
Last attacker activity
Was data acquired or only accessible?
Which data elements?
How many individuals?
States of residence, with counts
Any protected health information?
Any consumer report data?
Any children's data?
Any non-US individuals?
Any employee data?
Any customer/vendor confidential data?
Encryption status, and key compromise?
Is attacker access severed?

⭐ The gaps column is the most important one. Every gap becomes an assumption, and assumptions expand notification populations.

Tool 4 — Deadline Tracker

Obligation Authority Trigger date Deadline Owner Status
Customer contract notice Agreement § [ ] 24–72 hrs
Business associate notice 45 C.F.R. part 164 + BAA Per BAA
Insurer notice Policy § [ ] Per policy
Banking regulator incident report Agency rule Short
Public company disclosure 15 U.S.C. § 78m; 17 C.F.R. part 240 Materiality determination Prescribed
Individual notice — health 42 U.S.C. § 1320d Discovery 60 days
Secretary notice — health 45 C.F.R. part 164 Per rule
Media notice — health, ≥500 residents 45 C.F.R. part 164 60 days
Individual notice — state [ ] State statute [ ] days
Attorney general — state [ ] State statute [ ]
Consumer reporting agencies State statute Threshold
Financial safeguards notification 16 C.F.R. part 314 Per rule
Health app breach rule 16 C.F.R. part 318 Per rule
Children's data 16 C.F.R. part 312
Foreign regulator Applicable regime Short
  • Identify the single shortest deadline and work backward from it.
  • Assign a named owner to every row. The classic failure is two people each assuming the other owns notification.

Tool 5 — Determination Memorandum (No Notification Required)

PRIVILEGED — PREPARED AT THE DIRECTION OF COUNSEL Re: [Incident], determination regarding notification obligations Date: [ ]

1. The event. [Facts, with dates.]

2. Investigation performed. [Scope, tools, sources reviewed, who performed it.]

3. Findings. [Systems accessed; whether data was acquired; data elements; individuals; residences.]

4. Statutory analysis. For each potentially applicable regime: the trigger, whether it is met, and why. Address acquisition versus access, the data elements enumerated by the statute, and any encryption safe harbor including the key compromise question.

5. Risk-of-harm analysis (where the applicable statute permits, and in four-factor form where the health rule applies): the nature and extent of the information; the unauthorized person who used or received it; whether the information was actually acquired or viewed; and the extent to which risk has been mitigated.

6. Conclusion. Notification is not required under [regimes], for the reasons above. Notification is required under [regimes], and is being made.

7. Retention. This memorandum and the underlying materials are retained for [period].

Failure it prevents. A regulator asking, two years later, why no notice was given, and receiving no answer.

Tool 6 — Individual Notice Template

[Company letterhead] — [Date]

Notice of Data Security Incident

Dear [Name]:

What happened. On [date], [Company] learned that [plain description of the event]. We immediately [action], engaged outside cybersecurity experts, and began an investigation. The investigation determined that between [date] and [date], an unauthorized party [accessed/obtained] certain files.

What information was involved. For you, the information involved was: [list only the categories applicable to this recipient].

What we are doing. [Containment. Investigation. Specific controls added, with dates. Law enforcement notification if applicable.]

What you can do. [Specific steps: review statements; place a fraud alert; place a security freeze — which is free; change passwords and stop reusing them; watch for phishing referencing this incident.]

What we are offering. [Product] for [duration] at no cost. Enroll at [URL] with code [ ] by [date]. [What it includes.]

For more information. Call [number], [days and hours], or email [address]. [Website URL.]

We regret that this occurred and are taking it seriously.

[Name, title]

[State-specific required language and formatting inserted per applicable statute.]

Drafting rules. Facts first. Categories specific to the recipient. No opening statement about how much you value privacy. No passive voice for the intrusion. Do not say "no evidence of misuse" without saying what you examined. Do not send anything you may have to correct.

Tool 7 — Regulator Notice Template

[Date] — [Attorney General / Regulator], [address] Re: Notification of data security incident — [Company]

1. Reporting entity. Name, address, contact, and counsel. 2. Nature of the incident. Vector, systems affected, and dates of compromise, detection, and containment. 3. Chronology. Dated events from first indication through notification. 4. Data involved. Categories and volumes. 5. Residents affected. Number of residents of this state, and the date the number was determined. 6. Investigation. Who performed it and what was reviewed. 7. Remediation. Specific measures with dates. 8. Notification. Method, date sent, and the individual notice attached as Exhibit A. 9. Services offered. Product, duration, enrollment. 10. Contact. Name, title, phone, email.

Note. Many states prescribe a form and a portal. Use theirs. Keep the chronology identical across all state submissions — divergences are noticed and asked about.

Tool 8 — Holding Statement and Call Center Script

Holding statement (approve before you need it):

"We are aware of a security issue affecting certain [Company] systems. We took immediate steps to secure our environment, engaged outside cybersecurity experts, and are investigating. We will provide additional information as our investigation progresses, and we will notify affected individuals as required. We have no further details to share at this time."

Rules. One spokesperson. No attribution. No numbers until they are final. No speculation about scope. Everything else is "we are investigating."

Call center script skeleton:

Opening. "Thank you for calling about the [Company] notice. I can help with questions about the notice and enrollment." If asked what happened. Read the notice language verbatim. Do not elaborate. If asked whether their data specifically was taken. "The notice you received lists the categories of information involved for you." If asked how it happened. "The investigation determined [notice language]. I don't have information beyond the notice." If asked who did it. "I don't have that information." If asked about compensation. "The notice describes the services being offered. I can help you enroll." If angry. Acknowledge, do not argue, offer enrollment assistance, offer escalation. If a lawyer, regulator, or reporter. Transfer immediately to [name]. Do not answer questions. Escalation path. [Names and numbers.] Log every call: date, topic, outcome, escalation.

Tool 9 — Ransomware Decision Matrix

Question If yes If no
Are backups intact, offline, and tested? Restore; payment likely unnecessary for decryption Restoration path is the first problem
Was data exfiltrated? Breach analysis proceeds regardless of payment Encryption-only event; check statute
Does sanctions screening clear the actor? Payment may be considered Stop. No payment discussion
Has the insurer consented? Proceed with the analysis Resolve before any payment
Is a decryptor publicly available? Use it Continue analysis
Is the attacker still in the environment? Contain before anything else Proceed to scoping
Would payment change any notification obligation? It does not —

Rules. No contact with the threat actor without counsel. Preserve the note and all communications. The decision belongs to executives, not responders. Plan for publication, direct outreach to customers, and repeat targeting even after payment.

Tool 10 — Vendor Security Contract Clauses

Security program. Supplier shall maintain a written information security program aligned to [recognized framework], including access controls, multifactor authentication for administrative and remote access, encryption in transit and at rest, logging with retention of not less than [N] days, vulnerability management, and personnel training.

Incident notification. Supplier shall notify Company in writing within [24/48/72] hours of confirming a security incident affecting Company data, and shall provide updates not less than every [N] hours until closure.

Cooperation. Supplier shall cooperate fully in Company's investigation, including producing logs, forensic findings, and personnel for interview, and shall preserve all relevant evidence.

No independent notification. Supplier shall not notify Company's customers, regulators, or the public regarding an incident affecting Company data without Company's prior written consent, except as required by law.

Subprocessors. Supplier shall maintain a current list of subprocessors handling Company data and impose equivalent obligations on each.

Audit. Company may audit Supplier's controls relevant to Company data annually on [N] days' notice, or promptly following an incident.

Indemnity. Supplier shall indemnify Company for costs arising from an incident caused by Supplier's breach of this section, including investigation, notification, credit monitoring, regulatory response, and defense. This indemnity is excluded from any limitation of liability.

Data return and deletion. On termination, Supplier shall return or securely delete Company data within [N] days and certify deletion.

Termination. Company may terminate immediately for material breach of this section.

Failure it prevents. A vendor incident where you have no logs, no cooperation, no control over messaging, and an indemnity capped at one month's fees.

Tool 11 — Tabletop Exercise Script

Ninety minutes, once a year, with the people who would actually be in the room.

Scenario. Tuesday, 4:40 p.m. A customer emails support: "Why did I get a password reset email from you at 3 a.m.?" Support escalates at 5:15. At 5:30, the security lead finds the same pattern on eleven accounts, including two administrators.

Round 1 (15 min) — First thirty minutes. Who is called? Who declares an incident? Does anyone reset the administrator accounts, and does that destroy anything? Score: was the preservation instruction given?

Round 2 (15 min) — Engagement. Who calls counsel, and when relative to forensics? Is the insurer notified? Can anyone find the policy? Is the forensic firm on the panel?

Round 3 (15 min) — Preservation. Who issues the hold? Does anyone know whether log rotation will run tonight? Can someone actually disable it?

Round 4 (20 min) — Injects. (a) A reporter emails at 8 p.m. (b) The largest customer's security team invokes a 72-hour notification clause. (c) An executive proposes telling customers "there is no evidence of any data loss." (d) An administrator has already reimaged one server.

Round 5 (15 min) — Notification. Who owns the decision? What is the shortest applicable deadline? Can anyone say where the affected individuals reside?

Debrief (10 min). Every gap becomes an owned action item with a date. Re-run in six months if more than three gaps appear.

Tool 12 — After-Action Review Template

1. Timeline. Compromise → detection → containment → notification, with intervals computed. 2. Detection. Internal or third party? If third party, why did internal detection fail? 3. Evidence. What was lost, and at what step? 4. Privilege. Preserved? If not, where did it fail? 5. Deadlines. Which was tightest? Was it met? 6. The notice. What did it have to say that we wish it did not? 7. Prevention. Name the one control that would have prevented this. 8. Containment. Name the one control that would have contained it faster. 9. Logging. Which gap made scoping harder? 10. Vendors. Which terms failed us? 11. Cost. Investigation, notification, monitoring, legal, regulatory, business interruption. 12. Actions. Owners and dates, reviewed at ninety days.

Tool 13 — Incident Response Plan Skeleton

Keep it to four pages. Longer plans are not read at 2 a.m.

Page 1 — Who and how. Severity tiers with criteria. Who may declare an incident. The incident commander and backup, by name. The role roster. The escalation path. The after-hours contact list: counsel, forensics, insurer, key vendors, law enforcement, communications.

Page 2 — First actions. Isolate, do not power off. Capture memory. Image before remediating. Snapshot, do not terminate. Freeze log rotation. Issue the preservation hold. Call counsel before forensics. Notify the insurer. Open the decision log.

Page 3 — Decisions and owners. Who owns the notification decision, by name. Who approves external statements. Who authorizes payment discussions. Who signs regulator submissions. Who talks to enterprise customers.

Page 4 — References. Where the cyber policy lives. Where the data map lives. Where notice templates live. Where the vendor inventory lives. Where evidence is stored. The log retention table by system.

Tool 14 — Board Reporting Template

1. What happened, in three sentences. 2. What data was involved, and how many people. 3. What we have done, with dates. 4. What obligations apply, and the deadlines, with owners. 5. What it will cost, with ranges and the insurance position. 6. What litigation and regulatory exposure looks like, including that standing under TransUnion LLC v. Ramirez, 594 U.S. 413 and Spokeo, Inc. v. Robins, 578 U.S. 330 will be litigated first. 7. What we are changing, with owners and dates. 8. What we need from the board.

For public companies, add: the materiality determination, when it was made, by whom, and under what documented process — the timing of that determination now carries its own disclosure consequences under 15 U.S.C. § 78m and 17 C.F.R. part 240.

Tool 15 — Log Retention Table

Fill this in before an incident. It is the single most useful preparation document after the data map.

System Log type Retention Enabled? Where Owner
Email platform Mailbox audit
Email platform Message trace
Identity provider Authentication
Endpoint agent Telemetry
Firewall Flow
VPN / remote access Session
Cloud provider Audit / activity
Cloud storage Object access
Database Query / access
Application Application logs
Backup system Catalog
Badge system Physical access

⚠️ Two traps. Email audit logging often has the shortest retention of anything on this list. Detailed cloud audit logging is frequently an optional paid tier that was never enabled — and it is the log that answers the acquisition question.

Tool 16 — Quick Reference

Do Never
Isolate the system Power off, wipe, or restore over it
Capture memory and image first Remediate before preserving
Freeze log rotation immediately Let logs roll while deciding
Call counsel before forensics Engage forensics under an IT agreement
Address the report to counsel Circulate it to sixty people
Notify the insurer per policy Retain a non-panel vendor without consent
Identify the shortest deadline first Assume you have thirty days
Name an owner for the notification decision Assume someone else owns it
Send one accurate notice Send a notice you may have to correct
Write the determination memo when you do not notify Leave the analysis undocumented
Say only what is verified Speculate about scope or attribution
Preserve everything Delete anything — 18 U.S.C. § 1519

Related Documents