Is this checklist a substitute for an incident-response plan or professional advice?

No. Use it as a working prompt and adapt it to your systems, contracts, insurance, jurisdiction, and approved incident-response plan. Your technical responders and legal advisers should make decisions for the incident in front of them.

Does containment have to wait until evidence collection is complete?

No fixed rule works for every incident. The response lead should balance system safety, business impact, evidence needs, and the risk of further harm with technical and legal advisers. CISA's ransomware guidance tells organizations to isolate affected systems promptly, while NIST treats response and recovery as coordinated risk-management work. Record each action and its reason.

Can this checklist set our breach-notification deadlines?

No. Notification duties depend on the organization, affected people, data, location, regulator, contracts, and facts of the incident. Record awareness and discovery times, identify the rules that may apply, and ask qualified counsel to assess them against current official sources.

Does the checklist tell us whether to pay a ransomware demand?

No. A payment decision can involve sanctions, law enforcement, insurance, technical recovery, and business continuity. Bring qualified counsel, the incident lead, the insurer when applicable, and the appropriate authorities into the decision. Use current CISA and OFAC guidance rather than a generic rule.

Data Breach Response Checklist

Prepare before an incident

Review this section during planning and tabletop exercises.

Assign an incident commander, technical lead, scribe, legal contact, communications owner, and executive decision maker. Keep out-of-band contact details for staff, responders, counsel, insurers, and relevant authorities. Document logging sources, retention, time synchronization, evidence storage, and access controls. Test backups and record the recovery owner, restore process, and recovery acceptance criteria. Map critical systems, data owners, identity providers, vendors, and service dependencies. List contracts, insurance terms, and legal regimes that the response team may need to assess.

Open and triage the incident

Start a reliable record before the team loses track of events.

Record who reported the signal, the time received, and what the reporter observed. Preserve the original alert, message, log reference, screenshot, or source link. Identify affected accounts, systems, locations, data types, and business services known so far. Separate confirmed facts, working hypotheses, and unanswered questions in the incident log. Set an initial severity under the approved incident plan and name the person who can change it. Activate the internal team and retained responders that fit the current evidence.

Contain and preserve

Coordinate risk reduction with evidence work. A single rigid sequence can cause harm.

Choose isolation or access restrictions that match the threat, system safety, and operational impact. Preserve relevant logs, cloud audit records, alerts, snapshots, and forensic images where the response plan calls for them. Record the state before and after each containment action, including who approved it. Review active sessions, privileged access, tokens, keys, and accounts connected to the evidence. Protect known-clean communication and administration paths from the suspected compromise. Check whether a containment step could affect life safety, regulated operations, or evidence needed by responders.

Scope and remove access

Base remediation on tested evidence, not on a single indicator.

Build a timeline of initial access, execution, persistence, privilege changes, movement, collection, and exfiltration supported by evidence. Search related systems and identities for the same indicators and techniques. Identify the exploited weakness, exposed secret, configuration error, or supplier path where evidence supports it. Decide which systems can be cleaned, which need rebuilding, and how the team will validate the result. Patch or change the verified access path and test that the change did not break required services. Update the incident scope when new evidence changes affected systems, people, data, or vendors.

Recover and watch for recurrence

Use documented criteria to return services to normal operation.

Confirm that the restore source, build image, configuration, and credentials meet the recovery criteria. Restore services in an order approved by the system and business owners. Validate identity, logging, monitoring, backups, data integrity, and core business transactions after recovery. Set temporary monitoring and review owners for indicators tied to the incident. Record accepted residual risks, deferred fixes, and the executive who accepted each decision. Tell affected internal teams when service status changes and where they should report new symptoms.

Assess notifications and communications

Qualified advisers should apply current rules and contracts to the facts.

Record awareness, discovery, materiality, and scope decisions with their evidence and decision makers. Identify affected people, data, locations, regulators, customers, partners, insurers, and contractual notice clauses. Ask qualified counsel and privacy or compliance owners to assess current notification duties. Coordinate with law enforcement where the response plan, counsel, or incident facts call for it. Keep external statements accurate, limited to supported facts, and consistent across owners. Avoid publishing details that create added risk for affected people or the investigation.

Close and improve

Do this after owners agree that active response work has ended.

Confirm evidence retention, access, legal hold, and disposal requirements with the responsible owners. Compare the incident timeline with detection, escalation, containment, and recovery decisions. Assign fixes to named owners with review dates and evidence of completion. Update the response plan, contact roster, system map, logging, and tabletop scenarios. Share approved lessons with the teams that operate the affected systems.

Ransomware and extortion

Use the approved ransomware plan and current government guidance.

Determine which systems are affected and choose isolation steps with the incident lead. Protect backups and administration paths that the suspected actor may still reach. Preserve the ransom note, payment instructions, sample files, related logs, and communication records. Bring qualified counsel, the insurer when applicable, law enforcement, and technical responders into payment and recovery decisions. Check current sanctions and other legal issues before anyone facilitates a payment. Validate restoration and system integrity under the recovery plan even if the actor offers a decryptor.