Data Breach Response: A US Small Business Workbook

A data breach response plan should identify who can authorize containment, engage specialists and communicate with affected people. FTC guidance provides a starting point, but notification duties depend on the facts, data, locations and applicable rules. Do not assume one deadline covers every US business. Keep verified contact information for the administrator, legal adviser, insurer and relevant service providers outside the system most likely to be unavailable. Give each contact a role rather than leaving an unstructured phone list. Review the plan when the business begins collecting a new kind of sensitive information.

If an incident is suspected, record what was observed, when and by whom. Notify the approved response lead and avoid improvised deletion, reinstallation or public speculation. A specialist should guide isolation and preservation so that containment does not destroy useful evidence. Track affected accounts and systems in a controlled incident log. Separate confirmed facts from possibilities and identify what remains unknown. If a vendor is involved, obtain a responsible contact and preserve its communications. Continue essential work only through approved alternatives that do not copy exposed data into another unmanaged environment.

Review the insurance policy’s incident-reporting instructions before engaging outside support. Record the approved contacts and any required coordination. A preparation exercise should verify those routes without submitting a fictional claim or contacting outside organizations as if an incident occurred.

Restoring a service does not establish that the incident is over or determine whether notification is required. Work with qualified advisers to assess the affected information and applicable obligations. Prepare communications that describe verified facts and useful actions without promising facts the investigation has not established. Record the approval of each external statement. After recovery, test the corrective measures and update access, vendor and retention practices where needed. A tabletop exercise can rehearse these decisions using a fictional incident before a real emergency occurs. The outcome should be a clear chain of responsibility and evidence, not a claim that the business can guarantee prevention.