72-Hour Breach Response Guide
When an incident hits, the reporting clock may already be running. This guide walks your team through identification, containment, notification, and closure, plus gives you a customer email template and a print-ready checklist so nobody's improvising roles or wording in the moment.
Download document
Key Takeaways
- Establish incident response roles, severity levels, and escalation paths before an incident happens.
- The 12-step SOP runs from identification through post-incident review, with one incident lead owning coordination and the decision record throughout.
- Regulatory and contractual reporting clocks often start the moment the organization becomes aware, so legal/compliance escalation happens immediately, in parallel with technical investigation.
- All external communication should follow a "what we know / what we don't yet know / what we're doing" structure, and never present assumptions as confirmed facts.
- The customer notification email template is ready to adapt, paired with a short holding statement for the first hours when facts are still unconfirmed.
- Evidence preservation and a single authoritative timeline are maintained throughout so the incident can be reconstructed later.
- Closure needs required notifications, customer commitments, and retained documentation all have to be complete first.
- A post-incident review (within 5–10 business days) should assign an owner and deadline to every improvement identified.
- Regulatory classification and notification decisions need qualified legal review.
.avif)
