After a breach, contain it quickly, bring in forensic and legal help, reset credentials, fix the weakness, then work out who must be notified. The FTC's Data Breach Response guide for business sets out these steps in order. For a small organization the hard part is staying calm and writing things down.
Secure operations first
The FTC guide advises:
- Contain the breach. Isolate affected systems, but keep machines powered on until forensic experts arrive.
- Secure physical areas linked to the breach.
- Build a response team: forensics, legal, IT, communications and management. Bring in outside forensic investigators and privacy counsel.
- Reset passwords and credentials, since stolen logins stay useful until changed.
- Remove improperly posted personal data from your website and ask search engines and other sites to remove copies.
- Interview the people who found the breach and document the investigation without destroying evidence.
Do not wipe a device in a panic. You may need it to learn what happened.
Fix the weaknesses
Next, review your service providers' access and confirm they have fixed their own weaknesses. Check whether network segmentation contained the breach. Work with the forensic experts to review encryption, logs and access rights, restrict unneeded access and apply their fixes.
Prepare a communications plan for staff, families, donors and partners that is accurate and does not put people at more risk. Draft plain-language answers to likely questions and post them where people can find them.
Notify the right parties
Work out which federal, state and industry-specific notification rules apply. Notify law enforcement promptly. Check whether health-related breach rules apply. Tell affected businesses, such as banks holding compromised accounts. If Social Security numbers were exposed, alert the credit bureaus.
Notify affected individuals quickly, coordinating timing with law enforcement. The FTC says to explain what happened, what information was involved, what you are doing and what people can do. It suggests considering at least a year of free credit monitoring.
Before it happens
Write down who the response team is, with phone numbers that do not depend on your email. Know where your cyber insurance policy is and what number to call. See what to check in a policy.
Where state law fits
Notification rules vary by state and by data type, and deadlines differ. This guide does not list them. Ask counsel early, and check your funder and district contracts for notice duties too.
Quick check
Should I turn off the affected computer?
The FTC guide says to isolate affected systems but keep machines powered on until forensic experts arrive.
Sources
Last reviewed: 19 October 2026.
