A practical checklist to investigate, contain, and learn from a data breach
Data breaches can be hard to investigate when evidence is spread across different systems. This template helps security teams understand what happened, assess the impact, and respond effectively.
What you'll discover:
- Investigation steps: Assess the incident, build a timeline, and reconstruct the attack
- Breach impact: Identify affected systems, accounts, and data
- Evidence gaps: Track missing evidence and visibility gaps
- Containment and remediation: Document actions to stop the threat and fix weaknesses
- Security capabilities: Identify the visibility and tools needed based on the breach
Use the checklist to move from initial detection to final findings and understand what happened, what was affected, and what to do next.
Investigate with context. Respond with confidence.