# Incident record plan

Use this in one working session with the firm's counsel and its cyber policy in hand, before an incident, and again at each policy renewal. It settles who is called, what the firm writes down, and how findings reach it. The questions follow Woods, Böhme, Wolff, and Schwarcz (*Proceedings of the 32nd USENIX Security Symposium*, 2023) and the SEC's 2024 amendments to Regulation S-P. This is not legal advice; counsel confirms each answer.

**Firm / registration status (SEC-registered adviser / exempt reporting adviser / other):** ____________________

**Regulation S-P applies (confirmed by counsel, date):** yes / no / FTC rules instead: ____________________

**Prepared by / counsel present / date:** ____________________

**Cyber policy (carrier, policy number, renewal date):** ____________________

## First calls

| Order | Who | Number or channel | Owner at the firm |
| --- | --- | --- | --- |
| 1 | Insurer's incident hotline |  |  |
| 2 | Breach counsel (panel or firm's own) |  |  |
| 3 | Response firm (panel or firm's own) |  |  |
| 4 | Internal decision-maker (managing partner or CCO) |  |  |

- [ ] The firm has decided whether to use the insurer's panel responder or name its own on the policy, and the policy reflects that choice.
- [ ] The hotline number and policy number are stored somewhere reachable if email and the file server are down.

## The compliance record (Regulation S-P)

The firm keeps these itself, in writing, for five years (the first two easily accessible), if Regulation S-P applies.

- [ ] What was detected, when, and by whom.
- [ ] What was done to respond and recover, with dates.
- [ ] The investigation into whether sensitive customer information was accessed, and the notification determination with its reasons.
- [ ] Notices sent, to whom, and when (no later than 30 days after becoming aware, unless the determination says otherwise).
- [ ] Any written request from the Attorney General to delay notice.

**Who writes the compliance record during an incident:** ____________________

**Where it is kept, and who can access it:** ____________________

**Agreed with counsel: what it contains, and what it does not:** ____________________

## Findings and lessons

- [ ] Counsel has said how findings will reach the firm if no written report is produced (memo, oral briefing, slides).
- [ ] A named person at the firm writes the list of what failed and what will change, with owners and dates.
- [ ] The firm has asked counsel how that list can be kept so that it is used, not only protected.

**How findings will reach the firm:** ____________________

**Who keeps the lessons list:** ____________________

## Service providers

| Provider (administrator, IT, portals, CRM) | 72-hour breach notice in contract? | Notice goes to | Owner |
| --- | --- | --- | --- |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |

## Rehearsal

- [ ] A tabletop exercise has run from first alert to the 30-day notice decision, with counsel on the call.
- [ ] At the end, the firm produced the compliance record and a lessons list.

**Tabletop date / what could not be produced:** ____________________

**Next review (each policy renewal, and after any incident):** ____________________

## Common failure modes

- The first call is to a responder the policy will not pay for.
- Nobody at the firm writes anything down, because counsel said not to, and the rule's records do not exist.
- The forensics firm's recommendations are delivered orally and forgotten within a quarter.
- A service provider's breach notice arrives in a mailbox nobody reads.
- The firm assumes Regulation S-P applies, or assumes it does not, without asking counsel.

This plan covers the record and the roles around an incident. It does not replace the firm's incident response program or counsel's advice on privilege and notification.