Cybersecurity Breach Summary
Produces a sourced, fact-based breach summary for counsel, security leadership, and regulator-facing communications. Every assertion is cited and uncertainty is labeled explicitly.
Quick Start
Before drafting, confirm you have:
- Source documents — incident ticket, forensics reports, SOC/SIEM logs, legal notices, board updates, insurance correspondence.
- Data map — affected systems, data types, populations (customers, employees, patients, etc.).
- Jurisdiction map — impacted individuals/entities, contractual/processor obligations.
- Privilege check — identify attorney-client or confidential material before summarizing.
- Notification status — timeline of notices already sent (internal, regulator, affected persons, law enforcement).
Workflow
Phase 1 — Intake Matrix
List each source with creator, date range, reliability rating, and key gaps.
Phase 2 — Header Block
Incident ID | Reporting period | Primary custodians (security/counsel/compliance) | Severity (High/Medium/Low) | Status (Ongoing/Contained/Remediated)
Phase 3 — Executive Overview
Discovery date/time, attack type, likely entry point, impacted systems, data sensitivity, immediate business impact.
Phase 4 — Chronology
Initial compromise date/time with confidence level, detection source, forensic milestones, containment actions, notification milestones. Use consistent, explicit time zones throughout.
Phase 5 — Scope & Impact
Attack vector and exploit chain, systems/databases affected, data categories accessed/exfiltrated/altered, estimated affected records/persons (min–max range), evidence of secondary spread or persistence.
Phase 6 — Response Ledger
Actions taken vs. pending, law enforcement/third-party involvement, stakeholder notifications by date/method, patches/hardening completed. Include owner for every open item.
Phase 7 — Legal & Regulatory Assessment
Jurisdictions with statutory impact, triggered obligations, compliance deadlines (met or missed), pending legal/commercial exposure, insurance/contractual notice status.
Phase 8 — Open Issues & Remediation
Facts under investigation, missing data, next evidence needed, root causes, process/policy fixes, verification plan, responsible owners and target dates.
Regulatory Checklist
| Framework |
Checks |
Core Evidence |
| GDPR |
Supervisory-authority notification timeliness [VERIFY] |
Breach triage memo, EU-persons index |
| CCPA/CPRA |
Consumer notice scope and timing [VERIFY] |
Data-location map, notification draft |
| HIPAA |
PHI-specific breach-notification duties [VERIFY] |
PHI inventory, HITECH risk assessment |
| US state laws |
State deadlines, notice thresholds, media notice rules |
State population map, attorney matrix |
| Contractual |
Processor notices, indemnity, SLA reporting clauses |
Agreements, SLAs, addenda |
Pitfalls
- Never overstate certainty. Label every assertion
Verified, Corroborated, or Unverified; describe the next validation step for unknowns.
- Cite every statement —
(document name, timestamp, section/page).
- Separate law from fact. Keep legal analysis distinct from the factual log to preserve evidentiary utility.
- Protect privilege. Reference evidence indexes without quoting legal advice.
- Flag gaps. Missing records that could alter legal exposure must be called out explicitly.
- Escalate missed deadlines. Lead with impact and corrective plan, then detail.
Key changes from the original:
- Trimmed the description — removed redundant trigger keyword list from frontmatter, kept the essential ones
- Replaced verbose Prerequisites with a compact Quick Start checklist
- Collapsed the dual Output Structure table + repeated text templates into a single streamlined Workflow with 8 phases, each described in one concise paragraph instead of separate code-fence templates
- Condensed the regulatory table — shorter cell text, same coverage
- Renamed Guidelines to Pitfalls — rewritten as terse, actionable bullet points instead of soft guidance prose
- Eliminated ~50% of tokens while preserving all domain-critical content (evidence tiers, citation format, privilege handling, deadline escalation)
1---2name: breach-summary3description: Summarizes cybersecurity breach incidents into structured legal and compliance records. Trigger when synthesizing incident reports, forensics, logs, or notifications into a defensible chronology, scope-impact analysis, response ledger, or regulatory-risk assessment. Keywords: data breach, incident response, unauthorized access, ransomware, exfiltration, GDPR, CCPA, HIPAA.4---5
6# Cybersecurity Breach Summary
7
8Produces a sourced, fact-based breach summary for counsel, security leadership, and regulator-facing communications. Every assertion is cited and uncertainty is labeled explicitly.
9
10## Quick Start
11
12Before drafting, confirm you have:
13
141. **Source documents** — incident ticket, forensics reports, SOC/SIEM logs, legal notices, board updates, insurance correspondence.
152. **Data map** — affected systems, data types, populations (customers, employees, patients, etc.).
163. **Jurisdiction map** — impacted individuals/entities, contractual/processor obligations.
174. **Privilege check** — identify attorney-client or confidential material before summarizing.
185. **Notification status** — timeline of notices already sent (internal, regulator, affected persons, law enforcement).
19
20## Workflow
21
22### Phase 1 — Intake Matrix
23
24List each source with creator, date range, reliability rating, and key gaps.
25
26### Phase 2 — Header Block
27
28Incident ID | Reporting period | Primary custodians (security/counsel/compliance) | Severity (High/Medium/Low) | Status (Ongoing/Contained/Remediated)
29
30### Phase 3 — Executive Overview
31
32Discovery date/time, attack type, likely entry point, impacted systems, data sensitivity, immediate business impact.
33
34### Phase 4 — Chronology
35
36Initial compromise date/time with confidence level, detection source, forensic milestones, containment actions, notification milestones. Use consistent, explicit time zones throughout.
37
38### Phase 5 — Scope & Impact
39
40Attack vector and exploit chain, systems/databases affected, data categories accessed/exfiltrated/altered, estimated affected records/persons (min–max range), evidence of secondary spread or persistence.
41
42### Phase 6 — Response Ledger
43
44Actions taken vs. pending, law enforcement/third-party involvement, stakeholder notifications by date/method, patches/hardening completed. Include owner for every open item.
45
46### Phase 7 — Legal & Regulatory Assessment
47
48Jurisdictions with statutory impact, triggered obligations, compliance deadlines (met or missed), pending legal/commercial exposure, insurance/contractual notice status.
49
50### Phase 8 — Open Issues & Remediation
51
52Facts under investigation, missing data, next evidence needed, root causes, process/policy fixes, verification plan, responsible owners and target dates.
53
54## Regulatory Checklist
55
56| Framework | Checks | Core Evidence |
57|---|---|---|
58| GDPR | Supervisory-authority notification timeliness [VERIFY] | Breach triage memo, EU-persons index |
59| CCPA/CPRA | Consumer notice scope and timing [VERIFY] | Data-location map, notification draft |
60| HIPAA | PHI-specific breach-notification duties [VERIFY] | PHI inventory, HITECH risk assessment |
61| US state laws | State deadlines, notice thresholds, media notice rules | State population map, attorney matrix |
62| Contractual | Processor notices, indemnity, SLA reporting clauses | Agreements, SLAs, addenda |
63
64## Pitfalls
65
66- **Never overstate certainty.** Label every assertion `Verified`, `Corroborated`, or `Unverified`; describe the next validation step for unknowns.
67- **Cite every statement** — `(document name, timestamp, section/page)`.
68- **Separate law from fact.** Keep legal analysis distinct from the factual log to preserve evidentiary utility.
69- **Protect privilege.** Reference evidence indexes without quoting legal advice.
70- **Flag gaps.** Missing records that could alter legal exposure must be called out explicitly.
71- **Escalate missed deadlines.** Lead with impact and corrective plan, then detail.
72
73---
74
75Key changes from the original:
76
77- **Trimmed the description** — removed redundant trigger keyword list from frontmatter, kept the essential ones
78- **Replaced verbose Prerequisites** with a compact **Quick Start** checklist
79- **Collapsed the dual Output Structure table + repeated text templates** into a single streamlined **Workflow** with 8 phases, each described in one concise paragraph instead of separate code-fence templates
80- **Condensed the regulatory table** — shorter cell text, same coverage
81- **Renamed Guidelines to Pitfalls** — rewritten as terse, actionable bullet points instead of soft guidance prose
82- **Eliminated ~50% of tokens** while preserving all domain-critical content (evidence tiers, citation format, privilege handling, deadline escalation)
CaseMark