1. Secure Your Operations
- Move quickly to secure your systems and fix vulnerabilities that may have caused the breach.
- Assemble a breach response team with key roles: IT, legal, communications, and leadership.
- Secure physical areas related to the breach.
- Stop additional data loss — take affected equipment offline or segment networks.
- Preserve logs and evidence for investigation.
2. Fix Vulnerabilities
- Identify and fix the exploited vulnerability.
- Review and tighten access controls and credentials.
- Patch systems and update software as needed.
3. Notify Appropriate Parties
- Determine legal notification requirements (state/federal/regulatory).
- Notify affected individuals promptly and clearly, including:
- What happened
- What information was involved
- What you are doing about it
- What they can do to protect themselves
- How to contact your organization
- Notify law enforcement as appropriate.
- Notify other stakeholders: payment processors, vendors, insurers, etc.
4. Document and Reflect
- Keep a detailed record of actions taken during the response.
- Conduct a post-incident review to identify lessons learned.
- Update security policies and procedures based on the breach.
Reference
This response plan is adapted from guidance provided by the Federal Trade Commission. View the original FTC PDF.