72-Hour Breach Response Checklist

Critical actions to take in the first 72 hours after discovering a data breach

Hour 1: Immediate Response

Immediately contain the incident - disconnect affected systems, change passwords, or isolate the breach source

Contact key personnel: IT lead, management, legal counsel (if available)

Begin incident log with time, date, discovery method, and initial observations

Hours 2-6: Assessment & Containment

Determine what data was accessed, when the breach occurred, and how many people are affected

Take screenshots, preserve log files, and document all affected systems

Change all relevant passwords, update access controls, and patch vulnerabilities

Evaluate the risk to affected individuals - identity theft, financial harm, reputational damage

Hours 6-24: Investigation & Initial Communications

Determine root cause, timeline of events, and full extent of data compromised

If available, consult with legal team about notification requirements and liability

Draft regulator and customer notifications using our templates

Review cyber insurance policy and notify insurer if coverage applies

Hours 24-72: Notifications & Recovery

Submit formal breach notification within 72 hours (use our country-specific templates)

If high risk to individuals, notify them without undue delay with clear, helpful information

Address vulnerabilities that caused the breach and strengthen overall security

Continue monitoring for additional breaches, customer concerns, and regulator communications

Review response effectiveness and update policies and procedures

0% Complete

0 of 15 items completed