Customers ask the same ten questions after a breach. Draft the answer structure for each now, mark the facts that must be filled in, and get legal and leadership to approve the shape in advance. During an incident you then edit, rather than invent. The FTC guide also advises posting top questions and plain-language answers on your website.
The ten questions
- What happened? A short, confirmed description. Avoid theories.
- When did it happen and when did you find out? Give both dates, even if the second is embarrassing.
- Was my data involved? Use the three answers: yes, no with evidence, or not yet known. See how to answer "were we affected?".
- What data exactly? Categories, not vague "some information".
- Is the problem fixed? Say what was closed, what is still being worked on and what you are monitoring.
- What should I do now? Concrete steps: reset credentials, rotate keys, watch for phishing. Say what you will never ask for by email.
- Has anyone misused the data? Say what you know. "We have no evidence of misuse so far" is acceptable only if it is true and you are still looking.
- Did you tell the authorities? State which regulators and law enforcement you have notified, when this is accurate.
- How will you make sure it does not happen again? Describe real changes, not slogans. If the review is not done, say a summary will follow.
- Who do I contact? One named channel, with response hours.
Where to keep the FAQ
Keep one page that is the source of truth, linked from every email, status update and support macro. The FTC guide suggests posting updates on your website so consumers have one place to check the latest information.
Process around the FAQ
- One owner edits the page, and a second person checks it against the investigation notes.
- Add a dated change log at the bottom.
- Brief support before publishing, and give them the same text.
- Retire answers that become wrong. Never quietly edit a fact.
Practice
Run a tabletop where the prompt is a list of these ten questions, and time how long drafting the answers takes. Gaps in logs or inventory show up fast.
Sources
Quick check
Should the FAQ be public or only sent to customers?
Public if many customers are affected or you lack contact details for all of them, otherwise a link in the notice may be enough.
Who owns the FAQ?
Name one person, usually the incident communications lead.
Last reviewed: 19 October 2026.
