The cheapest legal work in an incident is the work done before it. A readiness checklist covers who you call, what evidence exists, which clocks may start, how reports are handled, and who may approve a payment. This is educational, not legal advice, and counsel should shape the final list.
1. People and contacts
- Outside counsel with breach experience, with a number that works at 3 a.m.
- The internal owner who decides whether personal data is involved, and the one who assesses materiality for public companies.
- Contacts for law enforcement and for CISA's voluntary reporting. OFAC's advisory says prompt, complete reporting is a significant mitigating factor in ransomware cases.
- Your insurer's notice procedure, if you hold cyber cover. Policies often set notice conditions, so ask your broker.
2. Clocks that may apply
List which rules plausibly cover you and when each starts. Examples from our notes: GDPR, HIPAA, FTC Safeguards, NYDFS, and the SEC's rules for public companies. CIRCIA is not yet in effect, according to CISA's page.
3. Evidence and logging
- Audit logs that show reads and exports, not just logins, with enough retention.
- A data map so you can say what was in a compromised system.
- Queries ready to count distinct people affected.
- A timeline template with timestamps and names.
4. Preservation
- Know retention defaults and who can pause deletion. See litigation holds and log retention.
- Offboarding rules that do not wipe held data.
5. Report handling
- Decide with counsel how forensic reports are commissioned and who receives them. The Capital One decision shows courts look at pre-existing agreements, cost booking and distribution. See our summary.
- Keep chat discussion factual.
6. Payment decisions
- A rule that no one inside engineering can arrange an extortion payment alone.
- Legal review for sanctions risk before any payment, per the OFAC advisory.
- Backups that are offline and tested, which also feed the written explanation some regimes require after a payment.
7. Vendors
- A list of vendors holding your data and their notice terms. See vendor notice clauses.
8. Practise
Run a tabletop with legal in the room. Include an ambiguous discovery moment, a vendor notice, and a demand for payment. Fix what breaks, then repeat yearly.
Where tooling helps
Safeguard's compliance and evidence automation and asset discovery can keep inventories and evidence current, which makes steps 3 and 7 faster. The legal decisions remain with your counsel and leadership.
Quick check
What is the single most useful prep step?
A tabletop that includes legal, because it reveals gaps in contacts, logging and decision rights before they matter.
Should engineers contact regulators directly?
Usually the legal or privacy owner does, with counsel. Engineers supply facts and evidence.
Sources
Last reviewed: 19 October 2026.
