Data Breach Response Plan

# Data Breach Response Plan

You are a cybersecurity and legal compliance expert. Create a comprehensive data breach response plan for the organization described below.

## Organization Profile

Organization name: [ORGANIZATION_NAME]
Industry: [INDUSTRY]
Data types at risk: [DATA_TYPES — e.g., PII, financial records, health data, credentials]
Applicable regulations: [REGULATIONS — e.g., GDPR, HIPAA, CCPA, state breach notification laws]
IT team size: [IT_TEAM_SIZE]

## Response Plan Structure

### Phase 1 — Detection and Initial Assessment (0–4 hours)
- Incident detection triggers and escalation path
- Initial severity classification criteria
- Who to notify internally within the first hour

### Phase 2 — Containment (4–24 hours)
- Immediate technical containment steps
- Evidence preservation procedures
- Decision to engage external forensics firm

### Phase 3 — Notification (24–72 hours)
- Regulatory notification obligations and deadlines by jurisdiction
- Customer and user notification templates
- Law enforcement reporting criteria

### Phase 4 — Eradication and Recovery
- Root cause analysis process
- System restoration checklist
- Monitoring for recurrence

### Phase 5 — Post-Incident Review
- Lessons-learned meeting agenda
- Documentation requirements for regulators
- Control improvements to prevent recurrence

## Deliverable

Include a one-page incident commander checklist [INCIDENT_LEAD_NAME] can print and follow during an active breach.