The first response decisions affect evidence preservation, containment, and recovery. The right order depends on the incident, so use a tested plan and involve the people responsible for security, operations, legal advice, and communications.
This playbook provides a step-by-step framework for responding to data breaches, from initial detection through recovery and lessons learned.
Phase 1: Detection and Initial Assessment
Step 1: Confirm the Breach
Not every security alert is a breach. Before activating full incident response:
- Verify the legitimacy of the alert or report
- Gather initial evidence (logs, screenshots, alerts)
- Determine if this is a false positive or actual compromise
- Document the discovery time and method
Step 2: Assemble the Incident Response Team
Activate the appropriate responders under your incident plan. Depending on severity, that group may include:
- Incident Commander: Overall decision authority and coordination
- IT/Security Team: Technical investigation and remediation
- Legal Counsel: Regulatory compliance and legal exposure
- Communications/PR: Internal and external messaging
- Executive Leadership: Business decisions and resource allocation
- HR (if needed): Insider threat or employee notification
- Third-Party IR Firm (if applicable): External forensics and expertise
Step 3: Preserve Evidence
Coordinate evidence collection with containment. Capture what is safe and useful without leaving an active compromise unchecked:
- Capture memory dumps from affected systems
- Export and preserve logs before they rotate or are deleted
- Take forensic images of compromised systems
- Document all actions taken (chain of custody for potential legal proceedings)
- Screenshot any dark web postings or threat actor communications
Evidence note:
Evidence preservation and containment often run in parallel. Volatile evidence can disappear when a device is powered down, while delayed containment can increase harm. Let the incident lead and forensic responder choose the sequence for the affected system.
Phase 2: Containment
Step 4: Implement Short-Term Containment
Limit damage while maintaining evidence and business operations:
- Isolate affected systems using the method chosen by the incident lead; avoid powering down a device when volatile evidence is needed unless disconnection is not possible
- Block attacker IP addresses and command-and-control domains
- Disable compromised user accounts and reset credentials
- Increase monitoring and logging across all systems
- Implement emergency firewall rules if needed
Step 5: Assess the Scope
Determine what was compromised:
- Which systems were accessed?
- What data was stolen or encrypted?
- How many records/users are affected?
- What was the initial entry point?
- How long did attackers have access?
- Are there additional persistence mechanisms or backdoors?
Step 6: Implement Long-Term Containment
Establish sustained defensive posture:
- Apply emergency patches to exploited vulnerabilities
- Force password resets for potentially compromised accounts
- Implement additional access controls and monitoring
- Segment network to prevent lateral movement
- Review and harden security configurations
Phase 3: Eradication
Step 7: Remove Attacker Presence
Eliminate all attacker access and persistence mechanisms:
- Remove malware, ransomware, and hacking tools
- Delete unauthorized user accounts and backdoors
- Close exploited vulnerabilities through patching
- Reset all potentially compromised credentials
- Rebuild severely compromised systems from known-good backups
Step 8: Verify Complete Remediation
Ensure attackers cannot return:
- Conduct full security scans across environment
- Review logs for any remaining malicious activity
- Verify all backdoors and persistence mechanisms are removed
- Test security controls are functioning properly
Phase 4: Recovery
Step 9: Restore Operations
Safely return systems to production:
- Restore from clean backups (verify backups aren't compromised)
- Rebuild systems that cannot be safely restored
- Implement additional monitoring on restored systems
- Gradually bring systems back online with validation
- Monitor closely for signs of re-infection
Step 10: Implement Enhanced Security
Restore service with the control changes identified during the investigation:
- Address vulnerabilities that enabled the breach
- Implement recommendations from IR investigation
- Deploy additional security controls and monitoring
- Update incident response procedures based on lessons learned
Phase 5: Regulatory and Legal Response
Step 11: Determine Notification Requirements
Work with legal counsel to understand obligations:
- GDPR: Article 33 may require supervisory-authority notice after awareness of a personal-data breach, subject to its risk exception and timing rules
- HIPAA: HHS guidance covers breaches above and below 500 individuals; the reporting time differs
- State Laws: Varying requirements across U.S. states
- Industry Regulations: PCI DSS, GLBA, etc.
- Contractual Obligations: Customer agreements may require notification
Step 12: Notify Affected Parties
When required, notify promptly and transparently:
- Regulatory authorities within required timeframes
- Affected customers/users with clear, honest communication
- Credit monitoring services if financial data compromised
- Law enforcement (FBI, local cybercrime units)
- Cyber insurance provider
- Business partners if their data was affected
Step 13: Manage External Communications
Control the narrative and maintain trust:
- Prepare holding statement for media inquiries
- Update website with incident information
- Designate single spokesperson for media
- Monitor social media and news coverage
- Provide regular updates as investigation progresses
Phase 6: Post-Incident Activities
Step 14: Conduct Post-Incident Review
Schedule the review soon enough that evidence and decisions are still available:
- Hold lessons-learned meeting with all stakeholders
- Document what happened, how it happened, and why it wasn't prevented
- Identify what worked well and what didn't in response
- Create prioritized remediation roadmap
- Update incident response plan based on lessons
Step 15: Implement Long-Term Improvements
Turn the incident into organizational resilience:
- Address root causes identified in post-incident review
- Implement security improvements and additional controls
- Update security policies and procedures
- Provide additional training to staff
- Consider penetration testing to validate improvements
Mistakes to Avoid
Protect useful evidence: Before reformatting or powering down a system, ask the incident lead whether volatile or forensic evidence is needed.
Don't Go Dark: Failing to communicate with stakeholders creates speculation and erodes trust.
Escalate ransom decisions: Payment does not guarantee recovery and can create sanctions risk. Involve leadership, counsel, the insurer where applicable, and law enforcement.
Track notification decisions: Counsel should identify applicable laws, contractual duties, decision owners, and deadlines from the facts of the incident.
Don't Restore Without Verification: Restoring from compromised backups or before eradication allows re-infection.
Measure your own response:
Track detection, verification, containment, recovery, and notification decisions. An external-source match can add a lead, but source coverage and collection latency vary.
Preparing Before a Breach Occurs
The best time to prepare for a breach is before it happens:
- Develop IR Plan: Document procedures, roles, and responsibilities
- Test IR Plan: Set an exercise schedule that fits the organization's risks and obligations
- Identify IR Partners: Pre-qualify forensics firms, legal counsel, PR firms
- Implement Dark Web Monitoring: Early warning when your data appears
- Maintain Backups: Regular, tested, offline backups
- Document Systems: Network diagrams, asset inventory, data flows
- Establish Baselines: Know what "normal" looks like in your environment
Conclusion
A tested plan gives the response team named owners, evidence rules, and decision points before an incident begins.
Adapt the playbook to the organization's size, industry, systems, and legal obligations. Test it through a tabletop exercise and record the changes that follow.
Measure notification time, evidence preservation, containment decisions, recovery steps, and overdue actions after each exercise or incident.