I've Been Breached — The First 72 Hours Command Kit

It is 6 a.m. and everything is encrypted. Five things are happening at once — forensics, legal, insurance, outages, customers — and the person who has to run them is not a security engineer. It is the owner, the GM, the general counsel or the CFO.

Every incident-response product on the market is written for the security team. This one is written for whoever is in charge of them. It is not a plan to write; it is the sequence, the people, the clocks and the words, organised so a non-technical executive can command five parallel lanes from a single decision log.

The two things that go wrong in the first hour. The first is evidence: leave the machines on and disconnect them — powering off destroys memory and, often, the encryption keys. The second is the call order: the insurer hotline comes before any vendor, because engaging off-panel forensics can void the coverage that pays for all of this. Those two facts are worth more than the rest of the kit combined, and they are on the card.

01 Hour-Zero Card (DOCX + printable PDF, one page) — DO and DO NOT in two columns, the seven calls in order with blanks for your own numbers, the five questions to ask forensics, and the clocks that may already be running. Print it. Put one at home, because this call comes at 6 a.m.

02 Crisis Command Workbook (XLSX, 8 sheets) — the roster with alternates and out-of-band contacts; 25 notification clocks computed from your discovery time, including the ones people do not know they have (customer contracts, PCI, FTC Safeguards, the credit bureaus, the 24-hour payment clocks, CISA, DFS, SEC, HIPAA, GDPR, DFARS); the decision log; 30 tasks across five lanes by hour; an outage register; a cost tracker already in insurer categories with a pre-approval flag; state notice patterns for 14 states; and a contacts sheet to fill in today.

03 The First 72 Hours Command Playbook (DOCX) — hour 0–1, 1–8, 8–24, 24–72, day 4–30. The five lanes and who owns each. Twelve mistakes that turn a bad week into a bad year.

04 Ransom & Extortion Decision Framework (DOCX) — eight gates in order: is it recoverable, is the actor sanctioned, is law enforcement engaged, has the insurer consented, and so on — plus the written record to keep and the mechanics either way.

05 Communications Pack (DOCX) — eleven templates: employee holding note, customer holding statement, contractual notice, press statement, an individual breach-notice skeleton that ends with the per-state additions for counsel, a phone script, the call-centre FAQ, the leak-site and harassment response, legal hold, vendor inquiry response, and an update cadence. Clocks run from discovery, not from confirmation, and the wrong sentence on day one is the one quoted back at you for two years.

06 Guide — I've Been Breached, Now What (PDF) — what it is actually like, who shows up and in what order, how insurance money works, what forensics can and cannot say at each stage, trading through it, the ransom decision, day 4–30, and realistic costs and timelines.

Prepare in a weekend. Read the playbook, print the card, fill the contacts and roster sheets, read your policy for the notice window and panel rules, mark your clocks, get the first two comms templates pre-approved by counsel, and run a 60-minute tabletop. That is the whole preparation, and it is the difference between the two outcomes.

Where this sits. The Incident Response Runbook Library is the technical side your MSP and forensics team run; the 2026 Ransomware Readiness Workbook is the 80-control preparedness assessment for a security team. This is the command layer above them, for the person who has to make the decisions and say the words. Pairs with the Cyber Insurance Application Readiness Kit — the controls that prevent the next one and the cover that pays for this one — and with CIRCIA 72/24, SEC 8-K and the NYDFS Part 500 Kit for the regime-specific reports.

Not legal advice, and on the day your breach coach makes the legal calls. The clocks and state notice patterns are a planning reference to verify, not a legal determination.