How to use this: Part 1 gets filled out this week and printed — keep a copy an
incident can't encrypt. Part 2 goes to counsel in hour one with the instruction "confirm the clocks."
Part 3 is written during the incident, one row per leadership decision, in plain language.
Context: Module 5 — Incident Decision-Making.
Part 1 — The Calm-Day Page (lessons 5.1–5.3)
| Outside counsel — firm / name / cell | |
|---|---|
| Insurance broker — name / cell | |
| Cyber policy — carrier / policy # / notice window | |
| Panel IR firms (from the policy) / endorsed firm | |
| FBI field office / IC3 contact | |
| Break-glass admin access — where it lives, last tested | |
| Who may declare an incident open / closed | |
| Update cadence default (internal / board) | |
| Ransom posture (pre-agreed, board-visible) | |
| Holding statement — where the pre-draft lives |
Part 2 — The Regulator Matrix (lesson 5.2)
| Obligation | Trigger | Clock | Owner | Confirmed for us? |
|---|---|---|---|---|
| SEC 8-K Item 1.05 (if public) | Materiality determination | 4 business days from determination | ||
| State AG notifications | Residents' PII breached | Varies by state — counsel's matrix | ||
| GDPR Art. 33 (if EU subjects) | Personal-data breach | 72 hours from awareness | ||
| Sector rules (HIPAA / GLBA / other) | ||||
| Cyber insurer notice | Suspected covered event | Per policy — "as soon as practicable" | ||
| Customer MSA breach clauses | Per contract | Shortest clause governs planning |
Part 3 — The Decision Log (lessons 5.1, 5.5)
One row per leadership decision — engage/spend/shutdown/contact/disclose/close. Contemporaneous entries only; plain language; note what was known at the time.
| Date / time | Decision | Decided by | Alternatives considered | Known at the time | Approver |
|---|---|---|---|---|---|