Incident response

Breach notification runs on statutory clocks, measured in hours in several regimes. Involve Legal & Risk and qualified counsel as soon as personal data may be involved — not after the technical work is done.

Decide it is an incident, and say so

The most expensive delay is the hour spent debating whether this is really an incident. Declare early; standing down a declared incident is cheap, and discovering an hour late that it was real is not.

Name an incident commander immediately. One person, coordinating, not doing the technical work. Everyone else has a defined job. Incidents fail on coordination far more than on technical capability.

Order of operations