In the first hour after security news breaks, do four things: name one owner, check whether you are exposed, set a status that says what you know and do not know, and tell the right people. Do not start patching or posting until the second step is done. Most news does not need a fire drill.
Minutes 0 to 10: name an owner
One person owns the question "does this apply to us?" until it is answered. Without a named owner, three people check the same thing and nobody tells the others. The owner can ask for help, but the thread has one name on it.
Minutes 10 to 30: check exposure
Use the same checks each time. Do we run the product, library, or service named? Which versions? Is the affected function reachable in our setup? Where is it deployed? Keep the questions short and the answers in one shared note.
If the story is about a supplier breach, ask what data and credentials you share with them, and look at when they were last rotated.
Minutes 30 to 45: set a status
Pick one of these labels and publish it internally:
- Not affected, with the reason.
- Affected, fix in progress.
- Possibly affected, investigating, next update at a stated time.
- Not enough information yet, next check at a stated time.
The commitment to a next update time stops the repeating question in chat.
Minutes 45 to 60: tell people
Send a short message to engineering leads and whoever speaks to customers. Say what you checked, what you found, and what you will do next. Leave out speculation. If customers may ask, give support a two line answer they can reuse.
After the hour
If action is needed, move it into your normal ticket flow with an owner and a date. If not, file the note. The CISA SSVC guidance frames outcomes as Track, Track star, Attend and Act, with Attend and Act calling for escalation and faster remediation than standard timelines. You can borrow that vocabulary for your own labels.
Review monthly
Look at the last month of notes. Which checks were slow? Was there a product you could not find in your inventory? Fix that gap before the next story.
Quick check
Who should own it?
Whoever can answer the exposure question fastest, usually a senior engineer or the security lead, with a named backup.
What if we cannot answer in an hour?
Say so, give the next update time, and keep going. An honest status is better than a guess.
Sources
- CISA, Stakeholder-Specific Vulnerability Categorization
- FTC, Data Breach Response: A Guide for Business
Last reviewed: 19 October 2026.
