## Contents

- Incident Response
- Breach Notification Checklist
- Post-Mortem Template

## Incident Response

### Breach Notification Checklist

1. **Contain** — Revoke compromised credentials, isolate affected systems
2. **Assess** — What data was accessed? How many users affected?
3. **Notify** — Legal team → affected users → regulators (GDPR: 72 hours)
4. **Remediate** — Fix the vulnerability, rotate all secrets
5. **Document** — Timeline, root cause, remediation steps

### Post-Mortem Template

```markdown
# Security Incident Post-Mortem

**Date:** YYYY-MM-DD
**Severity:** P1 (data breach) / P2 (vulnerability exploited) / P3 (vulnerability found)
**Status:** Resolved / Monitoring