ShareAndGoShareAndGo

Security

A data breach response playbook for American businesses.

The worst time to work out how you will respond to a breach is during one. In the first hours, people are anxious, facts are incomplete and every decision feels urgent. A short, agreed playbook turns that pressure into a sequence of steps.

This article outlines the phases most response plans share, the US notification rules that commonly come into play, and the records worth keeping throughout. Notification duties depend on your state, industry and the data involved. Involve an attorney experienced in privacy and data security early, and talk to your insurer if you carry cyber coverage.

Before anything happens

A playbook is worth writing now, while things are calm. It does not need to be long. It needs to answer a few questions that will otherwise eat the first day.

  • Who leads the response, and who is their deputy?
  • Which outside attorney, forensic firm and insurer will you call, and how?
  • Where is a current list of the systems and vendors that hold personal information?
  • How will the team communicate if email itself is compromised?
  • Who is allowed to speak to customers, staff and the press?

Tax preparers and other businesses covered by the FTC's Safeguards Rule are required to maintain a written information security program, which includes an incident response plan. The IRS publishes guidance for tax professionals on safeguarding taxpayer data, including Publication 4557.

The response, phase by phase

  1. 1

    Contain

    Stop the exposure from growing. Disable compromised accounts, revoke shared links and access, isolate affected machines and preserve evidence rather than wiping it.

  2. 2

    Assess

    Work out what happened, what data was involved, whose it was and which states they live in. Forensic investigators and counsel usually lead this step.

  3. 3

    Notify

    Decide, with counsel, who must be told and when: affected individuals, state attorneys general or other agencies, regulators, business partners and insurers.

  4. 4

    Recover and review

    Restore systems, fix the weakness that allowed the breach, and update the playbook with what you learned.

The notification landscape

There is no single federal breach notification law covering all businesses. Instead, every state, along with the District of Columbia and US territories, has its own data breach notification law. Those laws differ on what counts as personal information, what counts as a breach, how quickly notice must be given, what the notice must say and whether a state agency must also be told. When affected people live in several states, several laws can apply at once.

Federal rules apply in particular sectors and circumstances. A few examples:

  • Financial institutions under the FTC's Safeguards Rule, a category that includes many tax preparers, must notify the FTC of certain security events involving unencrypted information of 500 or more consumers, as soon as possible and no later than 30 days after discovery.
  • Public companies are expected to disclose material cybersecurity incidents under SEC rules, generally within four business days of determining that an incident is material.
  • Health care providers, insurers and their business associates have separate federal obligations for health information.
  • Federal contractors may have reporting duties set out in their contracts.

Contracts can add duties too. Customer agreements, vendor agreements and data sharing agreements often require prompt notice to the other party. Your counsel will map which duties apply and in what order.

When the breach involves shared documents

Many incidents are not dramatic hacks. They are a spreadsheet emailed to the wrong person, a link forwarded beyond its audience, or a former contractor who still had access to a folder. For these, the first questions are simple: what was in the document, who could open it, and who actually did.

If the documents were shared through a ShareAndGo room, you can act and answer quickly. Revoke an invitation immediately and the person loses access. Check the audit log, which records every view, upload, download, invitation and change with the person and time, chained so that alterations are detectable. Export it as CSV for your attorney and forensic team. Insights show which documents each person opened, and on the Professional and Business plans how long they spent on each.

Controls set beforehand shape how much a mistake can cost. Recipients confirm their email address with a six-digit code, so a forwarded invitation does not let a stranger in. View-only access means PDFs, Word, Excel and PowerPoint files were shown as watermarked renders and the original was not sent to the browser. Groups limit each audience to the folders they need. Invitations with end dates close access that would otherwise linger.

Records to keep throughout

Write things down as they happen. Regulators, insurers and affected people may ask later what you knew and when. Keep a dated log of discoveries, decisions and the reasons for them, copies of notices sent, and evidence preserved. Ask counsel how to structure that record, since some of it may be prepared at their direction.

Common questions

How fast must we notify people?
It depends on the state laws and any federal rules that apply. Some states set a fixed number of days and others require notice without unreasonable delay. Your attorney will advise.
Is a misdirected email a breach?
It can be, depending on what it contained and the law that applies. Treat it as a possible incident and ask counsel.
Can we see whether a revoked recipient opened a document first?
Yes. The audit log shows views and downloads up to the moment access was revoked.

Read next

The first 24 hours after a document leak

What to do, in order, when a file gets out.

The real cost of a privacy breach

Where the costs of an incident actually come from.

State privacy laws and document sharing

How state laws bear on the files you send.