

Closely monitor all entry and exit points, especially those involved in the breach.

Take all affected equipment offline immediately - but don’t turn any machines off until the forensic experts arrive. They can advise you on federal and state laws that may be implicated by a breach. Then, you may consider hiring outside legal counsel with privacy and data security expertise. They will capture forensic images of affected systems, collect and analyze evidence, and outline remediation steps.

Consider hiring independent forensic investigators to help you determine the source and scope of the breach. Depending on the size and nature of your company, they may include forensics, legal, information security, information technology, operations, human resources, communications, investor relations, and management. The exact steps to take depend on the nature of the breach and the structure of your business.Īssemble a team of experts to conduct a comprehensive breach response. Mobilize your breach response team right away to prevent additional data loss. Ask your forensics experts and law enforcement when it is reasonable to resume regular operations. Lock them and change access codes, if needed.
