Breach Response Playbook

Building Breach Response Team Playbook

Overview

A breach response team playbook is the operational manual that enables rapid, coordinated response when a personal data breach occurs. It pre-defines roles and responsibilities, escalation paths, communication templates, and external contact information so that the response team can act immediately without spending critical hours on logistics during an actual incident.

Team Structure — CSIRT + Privacy Integration

Core Response Team

Extended Team (Activated as Needed)

Escalation Matrix

Severity Classification

Escalation Flow

SOC Analyst detects alert
    ↓
SOC Lead validates (within 15 min)
    ↓
Personal data involved? → No → Standard security incident process
    ↓ Yes
Classify severity (SEV-1 to SEV-4)
    ↓
SEV-1/2: Activate Incident Commander + DPO immediately
SEV-3: Notify IC + DPO within 2 hours
SEV-4: Notify Privacy Coordinator within 4 hours
    ↓
IC convenes Core Response Team
    ↓
72-hour Art. 33 clock determination
    ↓
Investigation → Risk Assessment → Notification Decision

Communication Templates

Template 1: Internal Breach Alert (Email to Core Response Team)

Subject: [SEV-X] PERSONAL DATA BREACH — Immediate Action Required

From: SOC / Incident Commander To: Core Response Team distribution list

A personal data breach has been identified requiring immediate response.

Incident Summary:

• Discovery time: [UTC timestamp]
• Affected system(s): [system names]
• Breach type: [Confidentiality / Integrity / Availability]
• Estimated data subjects: [count or range]
• Personal data categories: [list]
• Containment status: [Contained / Active / Unknown]

Immediate Actions Required:

• IC: Convene response team call at [time] on [bridge/Teams link]
• DPO: Begin risk assessment; determine 72-hour deadline
• IT Forensics: Preserve evidence on affected systems
• Legal: Review for privilege and law enforcement considerations
• Communications: Prepare holding statement; monitor media

Response Team Bridge: [Teams meeting link] Incident Channel: Signal group "SPG-IR-Active"

Template 2: Media Holding Statement

Stellar Payments Group is aware of a security incident affecting [some of our systems / our customer database]. We immediately activated our incident response procedures and are working with leading cybersecurity experts to investigate the matter. The protection of our customers' data is our highest priority. We will provide further information as our investigation progresses. For media inquiries, please contact press@stellarpayments.eu.

Template 3: Customer Service Talking Points

For customer-facing staff during an active breach:

If a customer asks about a security incident:

• "We are aware of a security issue and our team is actively working to resolve it."
• "The security of your information is our top priority."
• "We will communicate directly with any affected customers as soon as our investigation allows."
• "I can take your contact details and ensure you are notified if your account is affected."

Do NOT:

• Confirm or deny specific details of the breach
• Speculate on the number of affected customers
• Provide information not in the approved talking points
• Discuss the incident on social media

Template 4: Board Notification (Email to Board Chair)

Subject: Data Breach Notification to the Board — [Breach Reference]

Dear [Board Chair],

I am writing to inform you of a personal data breach that occurred on [date]. This notification is provided in accordance with our Board-approved Incident Escalation Policy.

Summary: [2-3 sentence description] Scale: [approximate data subjects and data categories] Status: [contained/under investigation] Regulatory notification: [filed/pending/not required] Financial exposure: [estimated response costs and potential regulatory penalties]

A full briefing will be provided at [scheduled time]. In the interim, [CEO name] is overseeing the organizational response.

Template 5: Employee Communication (All-Staff)

Subject: Important Update from [CEO] Regarding a Security Incident

Dear Colleagues,

I want to share an important update. On [date], we identified a security incident affecting [description]. Our security and privacy teams are working around the clock to investigate and resolve the situation.

What we know: [brief, factual description] What we are doing: [containment and investigation actions] What this means for you: [if employee data was involved, say so directly; if not, clarify] What we ask of you: Report any unusual system activity to security@stellarpayments.eu. Do not discuss this matter externally or on social media.

We will provide updates as we learn more. Thank you for your professionalism and support during this time.

[CEO Name]

Regulatory Authority Contact Directory

European Union

United Kingdom

United States

Other International

Pre-Negotiated Vendor Contacts

Playbook Maintenance