An incident response is a compressed investigation with statutory deadlines running from the moment of discovery.
Engage counsel immediately so that the forensic investigation is directed by counsel and the privilege analysis is available. Retain the forensic firm through counsel under a scope directed at legal advice.
Contain and preserve. Isolate affected systems, preserve logs and images before remediation destroys them, and document decisions with timestamps.
Determine what happened and what was affected. Systems, data types, individuals, and jurisdictions. The notification analysis depends entirely on this, and premature conclusions in either direction cause problems.
Notification obligations. State breach statutes with varying triggers, content requirements and deadlines; sectoral rules for financial institutions and health information; contractual obligations to customers and business partners, often shorter than the statutory ones; insurance notice; and in some cases regulators and law enforcement.
Risk of harm analysis. Many statutes permit no notification where there is no reasonable likelihood of harm, but the analysis must be documented and in some states submitted.
Communications. A single approved factual narrative, updated as facts develop, with a discipline against speculation. Early public statements that prove inaccurate generate more liability than the incident.
Afterwards. Remediation, tabletop exercises, and a documented lessons-learned process.