Cybersecurity Breach Summary

Produces a sourced, fact-based breach summary for counsel, security leadership, and regulator-facing communications. Every assertion is cited and uncertainty is labeled explicitly.

Quick Start

Before drafting, confirm you have:

Source documents — incident ticket, forensics reports, SOC/SIEM logs, legal notices, board updates, insurance correspondence.
Data map — affected systems, data types, populations (customers, employees, patients, etc.).
Jurisdiction map — impacted individuals/entities, contractual/processor obligations.
Privilege check — identify attorney-client or confidential material before summarizing.
Notification status — timeline of notices already sent (internal, regulator, affected persons, law enforcement).

Workflow

Phase 1 — Intake Matrix

List each source with creator, date range, reliability rating, and key gaps.

Phase 2 — Header Block

Incident ID | Reporting period | Primary custodians (security/counsel/compliance) | Severity (High/Medium/Low) | Status (Ongoing/Contained/Remediated)

Phase 3 — Executive Overview

Discovery date/time, attack type, likely entry point, impacted systems, data sensitivity, immediate business impact.

Phase 4 — Chronology

Initial compromise date/time with confidence level, detection source, forensic milestones, containment actions, notification milestones. Use consistent, explicit time zones throughout.

Phase 5 — Scope & Impact

Attack vector and exploit chain, systems/databases affected, data categories accessed/exfiltrated/altered, estimated affected records/persons (min–max range), evidence of secondary spread or persistence.

Phase 6 — Response Ledger

Actions taken vs. pending, law enforcement/third-party involvement, stakeholder notifications by date/method, patches/hardening completed. Include owner for every open item.

Phase 7 — Legal & Regulatory Assessment

Jurisdictions with statutory impact, triggered obligations, compliance deadlines (met or missed), pending legal/commercial exposure, insurance/contractual notice status.

Phase 8 — Open Issues & Remediation

Facts under investigation, missing data, next evidence needed, root causes, process/policy fixes, verification plan, responsible owners and target dates.

Regulatory Checklist

| Framework | Checks | Core Evidence | |---|---|---| | GDPR | Supervisory-authority notification timeliness [VERIFY] | Breach triage memo, EU-persons index | | CCPA/CPRA | Consumer notice scope and timing [VERIFY] | Data-location map, notification draft | | HIPAA | PHI-specific breach-notification duties [VERIFY] | PHI inventory, HITECH risk assessment | | US state laws | State deadlines, notice thresholds, media notice rules | State population map, attorney matrix | | Contractual | Processor notices, indemnity, SLA reporting clauses | Agreements, SLAs, addenda |

Pitfalls

Never overstate certainty. Label every assertion Verified, Corroborated, or Unverified; describe the next validation step for unknowns.
Cite every statement — (document name, timestamp, section/page).
Separate law from fact. Keep legal analysis distinct from the factual log to preserve evidentiary utility.
Protect privilege. Reference evidence indexes without quoting legal advice.
Flag gaps. Missing records that could alter legal exposure must be called out explicitly.
Escalate missed deadlines. Lead with impact and corrective plan, then detail.

Key changes from the original:

Trimmed the description — removed redundant trigger keyword list from frontmatter, kept the essential ones
Replaced verbose Prerequisites with a compact Quick Start checklist
Collapsed the dual Output Structure table + repeated text templates into a single streamlined Workflow with 8 phases, each described in one concise paragraph instead of separate code-fence templates
Condensed the regulatory table — shorter cell text, same coverage
Renamed Guidelines to Pitfalls — rewritten as terse, actionable bullet points instead of soft guidance prose
Eliminated ~50% of tokens while preserving all domain-critical content (evidence tiers, citation format, privilege handling, deadline escalation)