Purpose of the Template
When a data breach affects millions, your team needs more than just internal resources. Take the Florida Department of Education's student financial aid website incident. They discovered the breach on October 19, initiated their response plan, contained the breach, and enlisted the Florida Digital Service and the Florida Department of Law Enforcement for assistance. This mix of internal containment and external collaboration is where many response plans falter. Roles become unclear, notification responsibilities are neglected, and public statements diverge from legal approvals.
This template provides a one-page coordination charter and a decision log. Use it to assign responsibilities across agencies before an incident and maintain a defensible record during one. While designed for public bodies, private enterprises with outsourced IT, forensic retainers, and law enforcement contacts can also use it.
Prerequisites
Before implementing the template, ensure you have:
- A current Breach Register. Log every incident, including near-misses, with discovery date, scope, and status.
- A data inventory with Data Labeling. Identify which systems hold Restricted Data like Social Security numbers or birth dates.
- Named contacts at each partner body. Include shared-services IT, law enforcement liaison, outside counsel, and forensic firm. Use phone numbers, not just email.
- Pre-approved authority to engage. Determine who can contact law enforcement or engage a shared-services team without budget approval.
- A jurisdiction map. List notification statutes relevant to your residents or data subjects. For GDPR, refer to Article 33 (notification to the Supervisory Authority within 72 hours) and Article 34 (communication to data subjects if risk is high). For UK General Data Protection Regulation, similar provisions apply. US state laws vary; confirm with counsel.
The Template
Copy the block below into your incident response runbook and replace bracketed fields.
MULTI-AGENCY BREACH COORDINATION CHARTER
Incident ID: [ID] Version: [n]
Discovery date/time: [UTC] Declared by: [name/role]
Systems in scope: [list] Data categories: [list]
Estimated individuals affected: [number or "under assessment"]
1. ROLES AND OWNERSHIP
Incident Commander (decisions, priorities): [name/role]
Technical Lead (containment, forensics): [name/role]
Legal Lead (notification analysis, privilege): [name/role]
[Chief Privacy Officer (CPO)](/glossary/chief-privacy-officer-cpo) / Chief Privacy Officer (CPO): [name/role]
Communications Lead (single voice externally): [name/role]
Partner liaisons:
- Shared IT/security service: [name, 24h contact]
- Law enforcement: [name, 24h contact]
- Outside counsel / forensic firm: [name, 24h contact]
2. DECISION CLOCK
T+0 Awareness established. Log time. Open Breach Register entry.
T+4h Initial scoping call. Confirm systems and data categories.
T+12h Legal Lead issues preliminary notification analysis.
T+24h Decision: engage law enforcement? Y/N, rationale: [text]
T+48h Draft notice to Supervisory Authority / regulators reviewed.
T+72h [Notification to Supervisory Authority](/glossary/notification-to-supervisory-authority) filed, or documented
reason why not required.
3. CONTAINMENT RECORD
Entry vector: [known / unknown / under investigation]
Containment action: [action] Time: [UTC] Owner: [name]
Evidence preserved (logs, images): [Y/N, location]
[Preservation Order](/glossary/preservation-order) issued: [Y/N]
4. COMMUNICATION RULES
- All external statements approved by Legal Lead and Comms Lead.
- Statements state only confirmed facts. Unknowns are labeled
"under investigation," not guessed.
- Service impact notice drafted: [Y/N]
- Individual notice drafted: [Y/N] Credit/identity support: [Y/N]
5. DECISION LOG (append every material decision)
[UTC time] | [decision] | [decided by] | [rationale] | [dissent]
6. CLOSURE
Root cause: [text] Corrective actions: [list, owner, due date]
Post-incident review held: [date] Register updated: [Y/N]
Customizing the Template
Roles. In smaller organizations, one person might hold multiple roles. However, avoid combining Incident Commander and Legal Lead, as these roles should provide checks and balances.
The decision clock. The 72-hour marker aligns with GDPR Article 33. If your jurisdiction has a different timeline, adjust accordingly and document any decision not to notify. Under GDPR, all breaches must be documented, regardless of notification.
Partner liaisons. Include every agency involved in the response. In the Florida incident, both a state digital service and a law enforcement agency were involved. Your list might include a regulator, insurer, payment processor, or university system. Specify each partner's role.
Communication rules. The Florida department informed the public that not all individuals were affected and specifics varied. This approach is honest and avoids overstatements. Prepare approved phrasing for uncertainties in advance. Also, address service continuity. Clearly state if services are unaffected or if disruptions will occur during remediation.
The "unknown" fields. Entry vectors and responsible parties may be unknown for some time. The charter allows for "under investigation." Avoid speculation in logs or public statements.
Repeat-incident awareness. Add a line in Section 3 to check for related incidents in your sector or jurisdiction. Credential compromise at a partner organization can lead to repeated breaches.
Validation Steps
- Tabletop it. Simulate a scenario where the entry vector is unknown and a partner agency detects unusual traffic first. Ensure your charter specifies who contacts whom.
- Time the clock. During the exercise, track the time taken to reach the T+12h legal analysis. If you miss it, identify the cause.
- Test the contacts. Call every 24-hour contact number. Resolve any issues immediately.
- Audit the log. Post-exercise, review the Decision Log as a regulator would. Ensure each decision and its rationale are clear.
- Check the Breach Register link. Verify the exercise entry includes all required fields.
- Review annually and after every real incident. Update contacts, thresholds, and statutory references. Record the review date in the charter.
A plan that's only on paper won't suffice when a breach occurs. Practice the handoffs and document decisions as they're made.
