Breach Aftermath Control Checklist

What will auditors, insurers and your board ask for after a breach?

The second wave of a breach is questions. This checklist takes eight answers about the incident and selects, from a fixed library, the controls to review, the evidence to gather, and the questions each party — customers, your cyber insurer, the board, your auditor, lenders — tends to ask, alongside the artifact that answers each one.

How this calculator works

Eight answers about the incident — its type, whether customer or personal data was involved, whether financial systems were touched, whether a vendor was involved, whether ransomware was involved, whether anything has been disclosed publicly, who is already asking questions, and what remediation evidence exists — select items from a fixed library of forty-five checklist items, forty-one stakeholder questions and thirteen worksheet rows. Nothing is written per incident, and roughly half the control-review items appear for everyone.

The score is a weighted count of how much follow-up scrutiny those answers imply, and it is dominated by who is already asking: each party is worth fourteen points out of a hundred. Financial systems touched is twenty, a public disclosure eighteen, ransomware sixteen, customer data ten, and no remediation evidence fourteen. Fifty or more reads high, twenty-five or more medium. Every term is itemised in the result, so the arithmetic can be checked.

One override sits on top of those bands: a confirmed exposure of customer or personal data can never read as low urgency and is raised to medium regardless of the total. A result can therefore read medium at a score of ten. The score itself is deliberately left alone, so the published weighting stays true.

An item marked critical means a party who is already asking will raise it — not that it is the most severe thing on the list. The warning about how the incident timeline and root-cause analysis are commissioned is arguably the highest-stakes item, and it is marked critical only when the board or the auditor is among those asking.

Nothing here is legal advice, and no notification obligation is decided. Which notification clocks may be running, whether anything is material, and whether a disclosure is required are all routed to counsel. This is preparation for the period after the immediate response is under control; during a live incident, counsel and an incident-response provider come first.

A worked example

A credential-compromise incident where customer data was involved, the effect on financial systems is not yet established, remediation is partly documented, and two parties are already asking questions.

Twenty-eight of the fifty-four points came from the two parties asking, before any fact about the incident itself. The combination bonus did not apply, because no ransomware, financial-system or disclosure confirmation was present. Notice that the item about how the timeline and root-cause analysis are commissioned renders as an ordinary gap here rather than flagged — not because it matters less, but because the parties who would raise it, the board and the auditor, have not started asking yet.

Common questions

Is this an incident response tool?

No, and it should not be used as one. It prepares for the questions that follow, once the immediate response is under control. In a live incident your counsel and your incident-response provider come first, and the checklist says so in its own words.

Does it tell me whether I have to notify anyone?

No. It tells you to ask counsel which notification clocks may already be running, and names the classes of obligation to put in front of them. Which ones apply to your facts is a legal determination the checklist deliberately refuses to make.

Is the score a measure of how bad the breach is?

No. It measures how much follow-up scrutiny your answers imply, and it is dominated by how many parties are already asking. A minor incident where all five parties are asking scores higher than a confirmed ransomware event that nobody has asked about yet.

What does a flagged item mean?

That a party you said is already asking will raise it. It describes a relationship to who is asking, not a severity ranking — a high-stakes item can appear unflagged simply because the party who cares about it has not come knocking yet.

Does it know anything about my incident beyond the eight answers?

Nothing at all. There is no log ingestion, no integration, and no document upload. Every word it prints was written in advance, and your answers only decide which of those words are selected.

Is the insurer section based on my policy?

No. It reflects what cyber insurers commonly ask about after an incident, written from practice. It is not a reading of your policy, your coverage or your carrier's requirements, none of which are visible to the checklist.