Playbook ID: PB-BREACH | Default severity: SEV-2 (escalate to SEV-1 when the confirmed set includes special-category, health or payment data at scale, when public notification is probable, or when the materiality assessment returns material) | Owner: Legal Liaison — the Incident Commander runs the incident, the Legal Liaison owns the determination track
Open this playbook the moment a technical incident touches a store of regulated data, and run it in parallel with whichever playbook owns the intrusion. Concrete triggers: a DLP egress alert matching a regulated data class; database audit records showing bulk reads by a principal outside its normal pattern; an object-storage bucket or database found publicly readable by anyone other than you; a researcher, journalist, customer or regulator telling you your data is somewhere it should not be; your records appearing on a leak site or in a paste; an extortion demand accompanied by a proof-of-life sample; a processor or vendor notifying you that data you control was involved in their breach; or a departing employee's exfiltration confirmed by 14.6.
Also open it when a contained intrusion turns out to have reached a data store — which is usually discovered in eradication, not in triage. Late entry into this playbook is normal. Late entry with no preserved logs is not.
This playbook is not for: the technical eviction — that belongs to 14.1, 14.3, 14.4, 14.5, 14.6 or 14.13, and this playbook does not duplicate it. It is not for an extortion demand with no verified data (verify the sample first, then close). It is not the regulatory reference: Chapter 15 holds the full notification matrix, the privilege guidance and the per-jurisdiction detail. What lives here is the sequence that turns a security incident into a defensible legal determination.
The hard part of this scenario is not the attack. In most cases the attacker left days or weeks ago and the technical work is somebody else's playbook. The hard part is that you now owe several regulators an answer to a question you cannot yet answer — what did they actually take? — and the clock on that answer started before you knew there was a question.
Here is the distinction the entire playbook turns on. An incident is what your SOC calls it. A breach is what a lawyer calls it, and only one of those two words has a statutory deadline attached. Worse, "breach" is not one definition. Under GDPR, a controller must notify once it "becomes aware" — a reasonable degree of certainty that a security incident compromised personal data — unless the breach is unlikely to result in a risk (Art. 33 GDPR, EDPB Guidelines 9/2022). Under HIPAA, access to unsecured PHI is presumed to be a breach unless a documented four-factor risk assessment shows a low probability of compromise — the presumption runs against you (HHS). Most US state laws require unauthorized acquisition, not merely access, and carry an encryption safe harbour. The SEC does not use the word at all; its trigger is a materiality determination (SEC). Four regimes, four definitions, four different starting states, and they diverge by days.
Then there is the mistake teams make, and they make it in both directions. Your entitlement report is a list of everything in the house. Your access logs are the security camera. Teams under pressure either notify everyone whose data the compromised account could reach — which is fast, defensible and can turn a 4,000-record incident into a four-million-record press release — or they notify only what they can positively prove left the network, which is honest right up until the regulator asks why the object-level logging was switched off. Equifax's attackers ran roughly 9,000 queries against databases that were neither segmented nor rate-limited (GAO-18-559); entitlement would have told you nothing useful, and the query log would have told you everything.
Actionable takeaway: build three separate columns for every data store in scope — what the principal could reach, what the logs show was read, and what left the network — and never let a number migrate between columns without a named person signing for it. That table is your notification scope, your regulator submission, and, eighteen months later, your defense.
| Role | Responsibility in PB-BREACH |
|---|---|
| Incident Commander | Runs the incident and owns the parallel technical playbook. Does not own the breach determination and cannot make it. Ensures the determination track is resourced separately so it does not queue behind eradication. |
| Legal Liaison | Owns this playbook. Retains outside counsel on day one; counsel retains the forensics firm. Signs each regime-specific determination and the decision not to notify. |
| Privacy Lead / DPO (scenario-specific) | Owns data classification of the result set, the risk and high-risk assessments, the residency mapping, and the record-of-processing evidence the regulator will ask for. |
| Notification Owner (scenario-specific) | One named person, distinct from the IC, who owns every clock: what is due, to whom, by when, filed by whom. Holds the notification register. |
| Operations Lead | Closes the exposure, exports and preserves the logs that answer the scope question, and reconstructs the access-versus-acquisition evidence. |
| Communications Lead | Individual notices, customer and partner notification, holding statement, call-centre stand-up, media and leak-site monitoring. |
| Scribe | Contemporaneous UTC timeline recorded off the affected estate. Captures the four timestamps below to the minute. |
| Executive Sponsor | Approves the cost of notification and remediation offers, approves public disclosure, and is the disclosure-committee chair for materiality. Cannot overrule a determination that notification is owed. |
Two markers appear in the tables. TIP-OFF means the step is observable by an adversary who may still be present. EVIDENCE means the step degrades evidence and requires the preceding capture step to be complete.
| # | Action | Who | Done when | Evidence to capture |
|---|---|---|---|---|
| 1.1 | Open a separate determination record from the technical incident ticket, with the four timestamp fields above as required, individually-editable entries. Record who set each and on what basis. | Scribe + Notification Owner | Record open, four fields present, first values set with rationale | The record itself; every subsequent edit with author and UTC time |
| 1.2 | Engage outside counsel before the first substantive assessment. Counsel then retains the forensics firm under a per-incident engagement letter scoped to legal advice. Instructing an existing vendor to "report to counsel" is not sufficient; privilege structured retroactively has repeatedly failed (Morrison Foerster). | Legal Liaison | Engagement letter signed and dated before scoping begins | Engagement letter date vs. first assessment timestamp |
| 1.3 | Verify the report is real and current before any clock argument starts. For an external report, obtain the sample, confirm the records are yours, confirm they are not a recycled third-party combolist, and hash the sample. | Ops Lead | Written verdict: ours / not ours / cannot yet tell | Sample file + SHA-256, provenance, reporter identity and contact time |
| 1.4 | Preserve before anything expires. Export identity and access logs against their real retention windows: Entra ID audit and sign-in are 7 days on Free, 30 days on P1/P2 and retention changes are not retroactive (Microsoft); CloudTrail console Event history is 90 days and covers management events only; Google Workspace email log search is 30 days; GCP Data Access logs default to 30 days and are off by default. | Ops Lead | Export jobs confirmed complete for every in-scope platform | Export job IDs, byte counts, source retention setting at time of export, hashes |
| 1.5 | Place the legal hold before scoping, not after. In M365 this is a Purview eDiscovery hold, which preserves against retention expiry and against deletion by a custodian or an actor (Microsoft). In S3, an Object Lock legal hold has no expiry, is independent of any retention period, applies per object version, requires S3 Versioning, and is placed by a principal holding s3:PutObjectLegalHold (AWS). | Legal Liaison + Ops Lead | Hold IDs recorded for every custodian and every evidence bucket | Hold IDs, scope, placement time, placing principal |
| 1.6 | Enumerate the data stores the access path actually reached and pull their classification records. Where no classification exists, produce one now for the stores in scope only — and log the absence as a finding rather than quietly inventing history. | Privacy Lead | Store list complete with a classification per store | Store inventory with owner, classification, classification date |
| 1.7 | Establish the encryption and key-custody position for each store: encrypted at rest, with which key, held where, and were the keys within the compromised principal's reach. This single fact determines whether GDPR Art. 34's unintelligibility exemption and the US state encryption safe harbours are available to you. Encrypted data plus stolen keys is not encrypted data. | Ops Lead + Privacy Lead | Per-store verdict recorded with supporting configuration evidence | Key management configuration, key access logs for the intrusion window |
| 1.8 | Classify along the six independent axes and run them in parallel, because the 24-hour clocks make a serial process fail by construction: personal data; our regulated service or network; our product in customers' hands (CRA Article 14, applying from 11 September 2026); public-company materiality; extortion demand or payment; AI system involved (EC). | Legal Liaison + Notification Owner | All six answered yes/no/unknown in writing | The six-axis assessment with author and time |
| 1.9 | Appoint the Notification Owner by name and hand them the register. This is not a duty the Incident Commander can also carry — under time dilation, the person running containment stops watching the clock. | IC | Named, briefed, register opened | Appointment time, register version |
In this playbook containment means two things at once: containing the exposure, so that you can truthfully tell a regulator further acquisition is no longer possible, and containing the record, so that the investigation you are about to run survives discovery.
| # | Action | Who | Done when | Evidence to capture |
|---|---|---|---|---|
| 2.1 | Close the access path. This step is owned by the parallel playbook; your job is to confirm it is done and get it in writing, because "the exposure is closed" is a sentence you will file with a regulator. TIP-OFF | Ops Lead + IC | Written confirmation with the specific control that closed it | Control change IDs, verification test result, time |
| 2.2 | Export the logs that answer what was read, before they roll off. In M365: Search-UnifiedAuditLog -StartDate <start> -EndDate <end> -Operations MailItemsAccessed -SessionCommand ReturnLargeSet -SessionId <id> -ResultSize 5000. Without -SessionCommand, the cmdlet returns at most 100 records however high you set -ResultSize; ReturnLargeSet returns unsorted data and must be re-run with the same -SessionId until it returns zero rows, and -ResultSize caps at 5,000 per call and 50,000 per session (Microsoft). In the results, read MailAccessType (Sync means a whole folder was accessed with no per-message detail; Bind is per-message), the SessionID field to separate the actor's sessions from the real user's, and IsThrottled — if more than 1,000 records were generated on a mailbox in under 24 hours, logging stopped for that mailbox for 24 hours (CISA). | Ops Lead | Extracts complete for every in-scope mailbox, each session paged until it returns zero rows, throttling checked | Extracts, IsThrottled values, throttled windows listed as gaps |
| 2.3 | In AWS, query object-level access. Note first whether S3 data events were ever enabled: trails and event data stores log management events but not data events by default (AWS). Query CloudTrail Lake with aws cloudtrail start-query --query-statement "SELECT ... FROM <event-data-store-id> WHERE ..." (Trino dialect, SELECT-only), then get-query-results. If data events were off, record that now — do not discover it on day 55. | Ops Lead | Query results retrieved, or the absence of data events documented | Query IDs and statements, results, or the written evidentiary gap |
| 2.4 | Pull the equivalent for every other store in scope: database audit logs, DLP incident records, proxy and flow records for egress volume, and file-share access auditing. Where the platform never had auditing enabled, enable it now and log the enablement time — everything before it is a gap, not a zero. | Ops Lead | Every store either has an access record or a documented gap | Per-store log source, coverage window, enablement times |
| 2.5 | Freeze the exposed data. Do not clean it up. No re-permissioning, no deleting the public objects, no "tidying" the compromised share until imaging and hold are complete. A well-meaning administrator destroying object versions is the most common evidence loss in this scenario. EVIDENCE | Ops Lead | Preservation confirmed before any remediation of the store | Snapshot or image IDs, hashes, operator, UTC time |
| 2.6 | Where data is already published, start takedown: host and registrar abuse contacts, search-engine cache removal, and platform reports. Record what was published, when, and for how long — the exposure window is a required input to the risk assessments in Phase 3. | Comms Lead | Takedown requests filed and tracked | Request IDs, URLs, first-seen and removed timestamps, copies preserved |
| 2.7 | Impose comms discipline in writing across every channel. Facts and timestamps in the incident channel; opinions, blame, attribution guesses and record-count estimates nowhere. In the SEC's action against SolarWinds and its CISO, internal presentations, emails and instant messages were the primary evidence (SEC). Distinguish "observed" from "assessed" in every entry. | Legal Liaison | Instruction issued and acknowledged by all responders | The instruction, acknowledgement list |
| 2.8 | Notify the insurer and pull the contractual clock inventory. BAAs routinely compress HIPAA's 60 days to 5–15 days; customer MSAs increasingly demand 24–48 hours; DFARS 252.204-7012 requires rapid reporting to DoD at dibnet.dod.mil within 72 hours of discovery plus 90-day media preservation. These are usually the first deadlines you actually miss. | Notification Owner | Insurer notified, contractual obligations extracted into the register | Carrier notification time, contract clause extracts with counterparty and deadline |
Eradication here is the elimination of uncertainty. This is the phase the playbook exists for, and it is the phase that gets compressed when the technical team declares victory and goes home.
| # | Action | Who | Done when | Evidence to capture |
|---|---|---|---|---|
| 3.1 | Build the access-versus-acquisition matrix: one row per data store, three columns — entitlement (what the principal could reach, from IAM policy and group membership), access (what the logs show was queried, read or listed), acquisition (what left the network, from egress, archive manifests or the actor's own file listing). Three columns, three evidence sources, never merged. | Ops Lead + Privacy Lead | Matrix complete, every cell either evidenced or marked as a gap | The matrix with a source citation per cell |
| 3.2 | For every gap, write the reason: logging not enabled, retention expired before export, throttled, or coverage does not span the intrusion window. Do not silently substitute entitlement for acquisition. Absent acquisition evidence, HIPAA's presumption and most regulators' expectations push you toward the entitlement set — that is a consequence of the gap, not an alternative to recording it. | Privacy Lead | Every gap has a written reason and a named owner | The gap register |
| 3.3 | Reconstruct the actual result set, not the table size. For a database, replay the recorded queries against a point-in-time restore in the forensic environment and count the rows actually returned. For file exfiltration, rebuild from archive manifests. A table with 40 million rows queried nine thousand times is not a 40-million-record breach until you show it was. | Ops Lead | Result set produced and hashed, with the reconstruction method documented | Query set, restore point used, result set hash, method write-up |
| 3.4 | Classify the result set against each regime's own element definitions, which differ. State personal information is typically name plus SSN, driver's license or financial account number, with most states now adding medical, health-insurance, biometric and online-account credentials — New York added medical and health-insurance information effective 21 March 2025 (Hunton). HIPAA turns on unsecured PHI. PCI turns on PAN and the elements that make it usable. | Privacy Lead | Element inventory per regime, with counts | Classification output, sampling method, reviewer names |
| 3.5 | Deduplicate to unique individuals and map residency. This drives everything downstream: state AG thresholds, HIPAA's media notice at 500+ residents of a single state or jurisdiction counted by residence rather than your location, Texas's 250-resident AG threshold, and California's requirement to send the AG a sample notice within 15 calendar days of notifying consumers where more than 500 California residents are affected (leginfo.ca.gov). | Privacy Lead | Deduplicated individual list with a residency count per jurisdiction | Dedup method, per-jurisdiction counts, unknown-residency count |
| 3.6 | Run each determination as a separate written assessment with a named decider: the HIPAA four-factor risk assessment; the GDPR risk and high-risk assessments including the unintelligibility exemption; the state-by-state risk-of-harm and encryption safe-harbour analysis; and the SEC materiality assessment convened as a disclosure committee. A decision not to notify is a determination and must be documented as one. | Legal Liaison + Privacy Lead | Each assessment signed and dated | The assessments themselves, with the evidence each relied on |
| 3.7 | Set the materiality determination cadence and hold to it. Item 1.05's four-business-day clock runs from determination, but the determination must be made "without unreasonable delay" — an indefinitely deferred determination is itself a violation, and undisclosed material facts create exposure independent of Item 1.05 (SEC). | Executive Sponsor | Cadence set, each session minuted with a verdict | Committee minutes, attendees, verdict and rationale per session |
| 3.8 | Apply the loop-back rule explicitly: any new evidence that changes the matrix sends you back to 3.1, re-runs every determination, and produces a supplemental filing. "We already notified" is not a reason to freeze a number that has been shown to be wrong. | Legal Liaison | Loop-back rule acknowledged; any re-scope logged as a new determination cycle | Re-scope trigger, revised matrix version, supplemental filings |
Recovery in this playbook is filing and telling people, in the right order, on time.
| # | Action | Who | Done when | Evidence to capture |
|---|---|---|---|---|
| 4.1 | File the sub-24-hour tier first, ordered tightest deadline first, and file incomplete rather than late. GDPR, NIS2, DORA and the CRA all expressly contemplate phased or incomplete initial reports. A 24-hour early warning saying "investigating, cause unknown, cross-border impact possible" is compliant. Silence is not. | Notification Owner | Every applicable sub-24h filing submitted with a confirmation reference | Submission times, portal references, exact text filed |
| 4.2 | Stage and file the 72-hour tier: GDPR Art. 33 / UK ICO within 72 hours of awareness, carrying the prescribed elements — nature of the breach, categories and approximate numbers of data subjects and records, DPO contact, likely consequences, and measures taken or proposed. If you will exceed 72 hours, the reasons for the delay are a required element, so draft them now rather than at hour 71. | Notification Owner + Privacy Lead | Filed, or filed late with reasons attached | Filing reference, the reasons-for-delay text, awareness timestamp relied on |
| 4.3 | Have disclosure counsel review the wording of every regulator-facing filing before submission. A technical team must not file a regulatory early warning unreviewed: anything you tell a CSIRT at hour 24 can be quoted back at you in securities litigation. | Legal Liaison | Counsel sign-off recorded per filing | Reviewed drafts, sign-off names and times |
| 4.4 | Stand up the call centre, the notification mailbox and any identity-protection offer before the individual notices go out. A notification letter pointing at a phone number that rings out converts a manageable incident into a news story. | Comms Lead | Capacity tested against the notified population size | Vendor contract, tested capacity, script version, go-live time |
| 4.5 | Send individual notices against the 30-day floor for multistate incidents, with the tightest carve-outs handled separately: Puerto Rico's 10 days to DACO (non-extendable) and Vermont's 14-business-day AG notice. Where you are a HIPAA covered entity, treat the 60 days as a ceiling, never a plan. | Notification Owner | Every jurisdiction notified within its own deadline | Per-jurisdiction send dates, mail vendor records, substitute-notice justification where used |
| 4.6 | File Form 8-K Item 1.05 within four business days of the materiality determination if the determination was material. Use Item 1.05 only for incidents determined material; voluntary disclosure of other incidents belongs under Item 8.01. | Legal Liaison | Filed, or a documented determination of immateriality on file | Filing, determination memo, the four-business-day arithmetic |
| 4.7 | Notify customers, partners and downstream controllers per the contractual clocks from 2.8. Sequence internally first: staff should see external communications before the public does, so they can answer the questions those communications generate. | Comms Lead | All contractual notifications sent within their own deadlines | Per-counterparty send records against contractual deadline |
| 4.8 | Hold the media line to what is established. Provide accurate information about impact, avoid hyperbole, and avoid anything that may have to be retracted — "no evidence of impact to personal data" is the sentence that ages worst (NCSC). Acknowledge the human impact, not only the technical facts. | Comms Lead | Holding statement approved by counsel and in the hands of every spokesperson | Approved statement versions, spokesperson list, media log |
| # | Action | Who | Done when | Evidence to capture |
|---|---|---|---|---|
| 5.1 | File the follow-up tier: NIS2 final report not later than one month after the incident notification, with a progress report at the one-month mark if the incident is still running; DORA final report no later than one month after the intermediate; CRA final report within 14 days of a corrective or mitigating measure becoming available for an actively exploited vulnerability, or within one month of the 72-hour notification for a severe incident; HIPAA breaches affecting under 500 individuals onto the annual log, filed within 60 days of year end. | Notification Owner | Every follow-up filed and referenced in the register | Filing references, submission times, content filed |
| 5.2 | Assemble the audit file as one package: the four timestamps with their basis, the determination memoranda with named deciders, the access-versus-acquisition matrix and its gap register, the notification register with filing confirmations, and the chain of custody covering RFC 3227's four requirements — who discovered and collected, who handled, who had custody and how it was stored, and how each transfer occurred (RFC 3227). | Scribe + Legal Liaison | Package complete, indexed, and retained under the hold | The package index and its retention decision |
| 5.3 | Close or explicitly extend the legal hold. An expired hold nobody closed and a released hold nobody documented are the same finding in an audit. | Legal Liaison | Release date recorded, or the extension and its rationale | Hold release or extension record |
| 5.4 | Fix the specific logging gap that made scoping hard. Enable S3 data events; enable the M365 events that still require manual activation — SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint, noting CISA's warning that adding the action converts the mailbox to an explicit action list, so re-verify with `Get-Mailbox <identity> \ | FL Audit` afterwards; and extend retention past the window a regulator will ask about. Default log retention periods are often insufficient, and it can take up to 18 months to discover an incident (CISA/ACSC). | Ops Lead | Each named gap closed and verified by a test query |
| 5.5 | Test the notification distribution list itself. Equifax's vulnerability notice went to an out-of-date recipient list and never reached the person responsible for patching (GAO-18-559). Your regulator contacts, portal credentials, DPO registration and outside-counsel numbers rot the same way. Run a cascade test on a schedule. | Notification Owner | Cascade test executed, every contact resolved | Test date, per-contact result, corrections made |
| 5.6 | Hold a blameless hotwash within ten business days covering the determination track specifically: where the scope estimate moved and why, which clock was closest to being missed, and whether roles and authority were clear. Every finding gets an owner and a due date. | IC | Findings logged with owners and dates | Hotwash notes, findings register |
Chapter 15 holds the full matrix. What starts a clock in this scenario is narrower than the incident itself, and the triggers are these.
Awareness that personal data was compromised starts GDPR and UK GDPR at 72 hours to the supervisory authority, and "without undue delay" to data subjects where the breach is likely to result in a high risk to rights and freedoms (ICO). Discovery of a breach of unsecured PHI starts HIPAA at 60 days to individuals and, at 500 or more affected, contemporaneously to HHS/OCR and to prominent media serving any state with 500+ affected residents. Determination of materiality starts the SEC's four business days. Determination that a cybersecurity incident occurred — at the entity, an affiliate, or a third-party service provider — starts NYDFS at 72 hours (23 NYCRR 500.17). And the contractual clocks from step 2.8 usually beat all of them.
One trigger in this playbook is not about your network at all: if the compromised thing is your product in customers' hands, CRA Article 14 applies from 11 September 2026 with a 24-hour early warning and 72-hour notification to the coordinating CSIRT and ENISA simultaneously. That path is tighter than the enterprise path and has no "where feasible" softener — keep it as a separate triage lane.
Three things in this playbook are races a human loses at 3am, and all three are safely automatable because they gather rather than change. Log export against retention windows (step 1.4) is the highest-value automation in the book: fire it on incident declaration, before anyone has decided whether this is a breach, because a seven-day Entra window does not care about your triage queue. Deadline computation from the four timestamps, with countdown alerting to the Notification Owner, removes the arithmetic error that causes most missed filings. Residency mapping and deduplication of the affected-individual list is a data-processing job that automation does better and more consistently than a tired analyst with a spreadsheet.
Everything downstream of the matrix is human-gated, and the gate is not negotiable. The breach determination, the classification of the result set, and any text that goes to a regulator or an individual require a named human approver, because a notification cannot be un-sent and a filed record count cannot be quietly revised. The two documented failure modes of AI agents in this space are overconfident closure backed by weak proof and hallucinated detail in investigation narratives — and here a hallucinated record count goes into a legal filing under someone's signature.
Where AI genuinely earns its place is classifying a large unstructured result set for regulated elements at a volume no review team can cover: run it across the whole set, have a human verify a statistically valid sample plus every positive class, and record the method and the sample result in the audit file. Takeaway: let automation gather, enrich and count; let it never determine, and never file.