Breach readiness
A named path for the hours after you suspect data left
A breach is an incident in which data about other people may have left the company’s control, or someone outside may have reached it. Readiness is not a promise that this will not happen. It is a named path for the hours after you suspect it has. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
What breach readiness is
The path has three parts. Someone can say which systems hold customer, employee, or payment data, and that list matches what is running. Someone owns the timeline while the facts are still changing. Someone is allowed to speak, and everyone else knows they are not.
REKKY Sec Ops Consulting writes those names with you. Control evidence and access review as a standing program are on SOC 2 readiness. If that is the request, we will point you there instead of folding it into a breach exercise.
Facts a notice needs
If counsel later says a notice is required, the notice is only as good as the facts under it. We help you list those facts in advance, as questions the timeline must be able to answer: which system, what categories of data, when you first suspected, when you confirmed, who already knows inside the company, and which vendor still has a copy.
We do not draft the legal notice, and we do not tell you that you must send one. That is legal advice, and it is not this engagement. We will sit with the person who would brief counsel so the brief is a timeline and not a debate.
A customer-service script written before the facts exist will be wrong. The playbook says who may speak and what they may say before the facts are confirmed, which is often very little. Silence with a named owner is better than three people giving three accounts.
Who speaks
We write a single speaker for customers, a single speaker for counsel or the insurer, and the operator who feeds both of them from the same timeline. If those are the same person in a small company, the plan says that. If they are different people, the plan says how the timeline reaches both.
Vendors who hold data are on the same page. The playbook names the person who owns the vendor relationship and the question they must ask: does the vendor still have the data, and who there would know. We need access to that owner. A contract in a folder, with no person, is not a role.
The tabletop for this page is a suspected export or a lost device, not a generic “security incident.” The room should include whoever would actually speak. We will not run it with only the technical staff if the speaker is someone else.
What this is not
We do not provide legal advice, regulatory opinions, or insurance coverage opinions. We do not predict fines. We do not tell customers anything on your behalf.
We do not take the investigation if the breach is active and you need a forensics firm. Say that in the first note. The readiness engagement is the path you use before that contract is the question, and the record you keep if you later hire one.
We work around your normal operations, and we'll need access to the right areas and the right people while we do. The people who would speak have to be part of the work. A plan that names them without their participation will fail on the afternoon it is needed.
Questions
Do you decide whether we must notify customers?
No. Whether a notice is required is a legal question for your counsel. We help you name the person who owns that decision and the facts the notice would have to rest on: what system, what data, what time, and who already knows.
What do you need from us during breach readiness work?
Access to the systems that hold customer data and to the people who would speak for the company: operations, counsel, and anyone who would call the insurer. We work around your normal operations, and we'll need access to the right areas and the right people while we do. We cannot name those roles from a blank note.
Contact
Task us with the system that holds the data.
If counsel is already involved, say so. We will work from their questions, not around them. We work around your normal operations, and we'll need access to the right areas and the right people while we do.