Free downloads
Four incident response resources, compiled from the documented guides on this site. No signup, no email wall, no marketing follow-up: click and you have the file.
Everything is operational guidance, not legal advice. Verify current notification rules with counsel before relying on them. Have a correction? Tell us →
The Incident Response Handbook
The compiled playbook for the first days of a breach: the first hour, choosing a responder in hours, ransomware's first 24, negotiation, incident command, every notification clock, the board briefing, the post-incident review, and what the incident should change.
Cover, contents, nine chapters, and a page of further guides.
Breach Notification Clocks Cheat Sheet
Every notification deadline on one page: GDPR 72 hours, HIPAA 60 days, state laws, SEC 4 business days, banking 36 hours, NYDFS, FTC Safeguards, Regulation S-P, the NAIC model law, and contractual clocks. With when each clock starts and who files.
Print it, date it, and pin it where the incident plan lives.
The First 24 Hours Cheat Sheet
The breach response checklist condensed for print: contain, preserve, and call in the first hour; scope and command in the first four; the clocks and the response through the first day; and the four things to never do at any hour.
The wall version of the full checklist guide.
Incident Response Plan Template
The fill-in plan: roles and alternates, severity tiers, response phases, the contact tree, the notification matrix with every clock from the cheat sheet, and the board briefing skeleton. Ready to adapt in your word processor.
The plan the handbook's chapter nine tells you to write.
Also free, runs in the browser
The Breach Cost Calculator puts dollar figures on the clocks: HIPAA and GDPR penalty exposure by culpability tier, per record and capped, from the same sources as the cheat sheet.