Incident Response

A post-incident security review checklist: what to examine after a breach or near-miss, from root cause and failed controls to vendor exposure, obligations and follow-through.

Build an incident response plan people can use at 2 a.m.: contact lists, severity levels, decision rights, short runbooks and notification clocks.

A zero-day emergency patching playbook: triggers, triage, exposure lookup, interim mitigations, emergency change, compromise checks, validation and updates.

CISA's proposed CIRCIA rule would have critical infrastructure entities report substantial cyber incidents within 72 hours. Who's covered and what to expect.

The amended FTC Safeguards Rule requires non-bank financial institutions to report breaches affecting 500 or more consumers within 30 days, from May 13, 2024.

The SEC cybersecurity disclosure rules require an 8-K within four business days of finding an incident material, plus new 10-K disclosures. Key dates inside.

How to run a tabletop exercise that finds real gaps: set objectives, pick participants, design scenarios and injects, facilitate well and follow up.

How the GDPR 72-hour breach notification rule works in practice: when the clock starts, what to report, when to tell individuals, and a workable response plan.