This checklist outlines the steps a company should take in response to a cyber incident. It includes determining if the incident warrants escalation, documenting decisions, mitigating any ongoing compromise, engaging legal counsel, activating an incident response plan, notifying relevant parties such as insurers and business partners, investigating the scope of data compromised, assessing legal obligations, determining if law enforcement or public notification is required, and implementing measures to prevent future breaches. The checklist emphasizes having an incident response plan in place before a breach occurs to facilitate a coordinated response.

1. Spencer Fane LLP | spencerfane.com
Cyber Incident Response Checklist
n Determine whether incident justifies escalation
n Begin documentation of decisions and actions
n Begin mitigation of compromise
n Engage experienced legal counsel to guide
through process, determine privilege vs
disclosure tracks
n Activate Incident Response Plan and notify and
convene Incident Response Team
n Notify cyber insurance carrier
n Notify affected business partners per contractual
obligations
n Engage forensics to mitigate continued harm,
gather evidence, and investigate
n Assess scope and nature of data compromised
n Preliminarily determine legal obligations based
on type of data and jurisdictions
n Determine whether to notify law enforcement
n Begin preparing public relations message
n Engage notification / credit services vendor
n Investigate whether data has been “breached”
n Determine when notification “clock” started
n Remediate and protect against future breaches
n Confirm notification / remediation obligations
n Determine proper remediation services
n Assemble contact information for notifications
n Prepare notification letters, frequently asked
questions, and call centers
n Plan and time notification “drop”
n Implement public relations strategy
n Administrative reporting (AGs, HHS, FTC, SEC)
n Implement Cyber Risk Management Program
Assess
Cyber Risk
Strategic
Planning
Deploy
Defense
Assets
Develop,
Implement &
Train on P&P
Tabletop
Testing
Reassess
& Refine
Cyber Risk
Management
Program
“Firms must adopt written policies to protect their clients’ private information . . . they need to anticipate
potential cybersecurity events and have clear procedures in place rather than waiting to react once a
breach occurs.”
– S.E.C. v. R.T. Jones Capital Equities Mgt.