Data breach response plan: who does what in the first 72 hours

Why your business needs a data breach response plan

When a business realizes that sensitive data has been accessed by an unauthorized party, the immediate reaction is often panic. A data breach response plan is designed to replace that panic with a set of pre-defined, logical steps. For small businesses, especially those in regulated industries like healthcare or finance, having a plan is not just a best practice—it is often a legal requirement. The way you handle the first few hours can determine the total cost and the impact on your reputation.

The goal of the plan is to contain the breach, protect the remaining data, and ensure the business meets its legal obligations to notify customers and authorities. It ensures that everyone in the company knows their role and who is in charge.

Phase 1: Detection and containment (Hours 1-12)

As soon as a breach is suspected, the first priority is to stop the bleeding. This involves identifying the source of the breach and isolating the affected systems. However, it is vital that you do not simply wipe or delete affected files, as this destroys the evidence needed to understand how the breach happened. Disconnecting a computer from the network is usually better than turning it off, as some evidence only exists in the computer's temporary memory.

1. Disconnect infected computers from the network but do not turn them off.
2. Change passwords for all administrative accounts immediately using a clean device.
3. Identify which systems and data sets have been accessed by the attacker.
4. Notify your IT security team or external provider to begin the investigation.

Phase 2: Assessment and investigation (Hours 12-24)

Once the breach is contained, you need to understand the scope. What kind of data was taken? Was it personal identifiable information (PII), health records (PHI), or financial data? The answer to this question determines your legal notification requirements. This is also the time to contact your cyber insurance provider, as they often provide access to forensic experts who can assist with the investigation. Forensic teams can help piece together the attacker's path and confirm exactly what was stolen.

Phase 3: Legal and regulatory notification (Hours 24-72)

Many laws, including GDPR in Europe and various state laws in the U.S., have strict timelines for reporting a breach. For example, some regulations require notification within 72 hours of discovery. Your data breach response plan should include a list of the regulatory bodies you may need to notify, such as the Department of Health and Human Services (HHS) or state Attorneys General. Failure to notify within these windows can result in significant fines.

• Consult with legal counsel to determine notification obligations for your specific industry.
• Draft a clear, honest statement for affected customers that explains what happened.
• Notify law enforcement if necessary, such as the FBI's Internet Crime Complaint Center (IC3).
• Prepare your staff to handle incoming questions from customers and the media.

Phase 4: Recovery and remediation

After the immediate crisis has passed, the focus shifts to restoring systems and ensuring the same breach cannot happen again. This involves patching the vulnerabilities that were exploited and reviewing your security posture. It also includes long-term monitoring of the affected data to see if it appears on the dark web. The final step of any response plan is a 'post-incident review' to learn what worked and what didn't.

A data breach response plan checklist

• Appoint a Breach Response Team (Leader, IT, Legal, Comms).
• Create a list of all data types stored and the laws that apply to them.
• Keep a 'paper' copy of the plan and contact lists outside the main network.
• Establish a relationship with a cyber forensics firm before a breach occurs.