When CenterPoint Energy took a month to disclose unauthorized access to customer data, it highlighted a common issue: many organizations lack structured breach response protocols. If you manage critical infrastructure, this checklist will help you address those gaps. It incorporates requirements from GDPR Article 33, SEC disclosure rules, and essential security controls for externally accessible systems.
Prerequisites
Before using this checklist, ensure you have:
- A documented inventory of all externally facing systems with data classification labels indicating which systems process personal data.
- A named incident response team with assigned roles, including a coordinator, legal counsel, technical lead, and communications officer.
- Access to breach notification templates pre-approved by legal for supervisory authority, SEC (if applicable), and affected individuals.
- Current contact information for your supervisory authority and, if applicable, your SEC filing team.
Without these elements, your response procedures are on shaky ground.
Detection and Initial Assessment
☐ Log the incident in your breach register within 24 hours of discovery
Record when you became aware of potential unauthorized access. GDPR Article 33 starts the 72-hour notification clock from awareness, not the intrusion. Ensure you have a timestamped entry with the discovery method documented.
☐ Classify the breach severity using your documented risk framework
Determine if the breach poses a "risk to rights and freedoms" under GDPR Article 33 or is "material" under SEC rules. Base this on specific criteria, not intuition.
☐ Activate your incident response team within 4 hours of classification
Gather all named roles immediately. Delays can mean missing your notification window. Document the activation time and confirm all roles are available or backups are assigned.
☐ Isolate the compromised system and preserve forensic evidence
Capture logs before taking systems offline. Preservation is crucial. Create a forensic image, export access logs, and document the isolation with a timestamp.
Investigation and Scope Determination
☐ Identify all data types accessed through the compromised system
Specify categories like names, addresses, and identification numbers. A vague "customer data" label isn't enough. Use a data mapping document to show exposed database tables or file stores.
☐ Determine the count of affected individuals
Use database queries or system logs for accuracy. If an exact count isn't possible, document your methodology for estimating "approximately X."
☐ Establish the timeline: first unauthorized access to containment
This timeline informs your risk assessment and notification content. Document evidence for each date, including log entries and containment actions.
☐ Document the attack vector and root cause
Identify the specific vulnerability exploited, such as unpatched software or credential compromise. Provide a technical analysis detailing the issue.
Regulatory Notification
☐ File supervisory authority notification within 72 hours if required
GDPR Article 33 requires this for breaches likely to risk rights and freedoms. Use the designated submission method and obtain a confirmation receipt.
☐ Submit SEC Form 8-K within 4 business days if you're publicly traded
Material cybersecurity incidents require disclosure. Coordinate with legal counsel on materiality determination and document legal sign-off.
☐ Notify state attorneys general if required by state breach laws
Check each state's requirements if you serve customers in multiple states. Maintain a notification matrix and filing confirmations for applicable states.
Individual Notification
☐ Send individual notifications without undue delay after authority notification
If the breach poses high risk, GDPR Article 34 requires prompt communication. Aim to send notifications within 7 days of authority filing.
☐ Include all required elements in individual notifications
Describe the breach, its likely consequences, measures taken, and recommended protective steps. Ensure all elements meet GDPR Article 34(2) requirements.
☐ Offer identity monitoring or credit protection if identification numbers were exposed
Provide protection services for exposed driver's license or Social Security numbers. Have a monitoring service contract ready before sending notifications.
System Remediation
☐ Patch or reconfigure the compromised system to close the attack vector
Address the root cause and apply fixes to similar vulnerabilities in other systems. Document patch deployment and verify through testing.
☐ Implement additional authentication for externally facing systems processing personal data
Use multi-factor authentication or IP allowlisting to reduce credential compromise risk. Verify enforcement through access testing.
☐ Deploy monitoring for similar attack patterns across your environment
Set up SIEM rules to detect similar access patterns and complete alert testing.
Common Mistakes
- Waiting for investigation completion before filing supervisory authority notification. GDPR Article 33 allows phased reporting. File initial notification within 72 hours and update as needed.
- Treating SEC filing as sufficient public disclosure. SEC Form 8-K reaches investors, not affected individuals. Direct notification is still required under data protection laws.
- Using "approximately" for affected individual counts without documentation. If estimating, document your methodology. Regulators will want to know how you arrived at that number.
- Assuming all externally facing systems are in your asset inventory. Shadow IT and forgotten environments can create blind spots. This breach should prompt a full external perimeter review.
Next Steps
Within 30 days of containment, conduct a post-incident review. Document successes, failures, and potential control improvements. Update your Technical and Organisational Measures documentation accordingly.
Within 90 days, audit all other externally facing systems for similar vulnerabilities. If one system was exploitable, others might be too.
Schedule annual penetration testing focused on your external attack surface. Internal audits often miss what external attackers see first.
