Draft the first-72-hours breach response one-pager
This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.
Industry, size, what data you hold, and the commitments you have made about it.
The playbook changes materially by scenario: containment, evidence, and who you call first are all different.
Which privacy, sector, and securities regimes reach you, and which supervisory authority is likely lead.
Carrier, notice window, panel counsel requirements, and whether forensics is on retainer.
Watch for these throughout
Notification clocks usually run from awareness, not from the incident, and awareness is a legal determination someone has to make and document. Fix the moment in writing when you make it.
Cyber policies commonly require notice within a short window and may condition coverage on using panel counsel and pre-approved forensics. Read the policy before you retain anyone.
Do not investigate on original media. Image first and analyze the image, or you will lose evidence and the ability to prove what happened.
Public-company disclosure obligations run on a different and shorter track than privacy notification. If your company is public or has public debt, that analysis starts on day one.
This brief is a plan, not advice for a live incident. Once something real is happening, engage counsel and forensics rather than following a document the model wrote in advance.