🚨 Cyber Incident Response — If you are actively under attack, call your cyber insurer and IT provider immediately before using this form.
🚨 Breach Response

Cyber incident response

If you suspect or have confirmed a security breach, follow this checklist. Time matters — every hour of delay increases the damage.

🛡
Cyber insurance
Call your insurer immediately — most policies require notification within 24 hours
⚖
Legal counsel
Privacy breach has legal implications — get counsel before communicating externally
💻
IT / MSP
Your managed service provider needs to contain and investigate
🍁
Privacy Commissioner
Office of the Privacy Commissioner: 1-800-282-1376

72-hour response checklist

0–1 hr
Contain the breach
→Disconnect affected systems from the network
→Change all administrator passwords immediately
→Preserve logs — do not delete anything
→Document everything with timestamps
1–4 hrs
Assess the damage
→Identify what data was accessed or exfiltrated
→Determine how the attacker got in
→Identify all affected systems and accounts
→Contact your cyber insurance provider
4–24 hrs
Notify stakeholders
→Contact your legal counsel
→Brief your leadership team
→Prepare customer notification if personal data was involved
→Engage an incident response firm if needed
24–72 hrs
Regulatory notification
→Report to the Office of the Privacy Commissioner if PIPEDA applies
→Report to the CAI if Quebec Law 25 applies
→Notify affected individuals if there is real risk of significant harm
→Document all notifications with timestamps
Log this incident in Guardlyne

Logging an incident creates a timestamped record that may be required for insurance claims and regulatory notifications.