Disclaimer

Who this is for. After a Breach is a Day-1 guide for organizations that do not already have an incident response plan. If you have a tested plan, a retained incident-response firm, or counsel guiding you, follow them. This tool does not replace them.

General information only. The content is educational and general. It is not legal, forensic, regulatory, insurance, or other professional advice, and it does not create an attorney-client, consulting, or other professional relationship with anyone.

Laws change and vary. Notification duties depend on the facts, your industry, where affected people live, your contracts, and your insurance policy. Anything this tool says “may apply” must be confirmed with qualified counsel. This tool currently addresses NIST guidance and US federal rules only; it does not cover state or non-US laws.

No guarantee. We work to keep information accurate and cite our sources, but we make no warranty that it is complete, current, or suitable for your situation. You use it at your own risk.

Emergencies. If anyone is in danger, call 911 (or your local emergency number). To report a crime, contact law enforcement.

Safety-critical reminders. Do not wipe or reimage systems before preserving evidence. Do not pay a ransom without advice from counsel and law enforcement. Do not discuss the incident over a channel that may be compromised.

Independence. This is an independent tool based on public NIST guidance. It is not affiliated with or endorsed by NIST, CISA, the FTC, HHS, the SEC, or any other agency.

Publisher and links. After a Breach is published by InventiveHQ, which also sells cybersecurity products and services. Where we point to InventiveHQ offerings, they are labeled and the guidance does not depend on them.

Your information. In guest mode, your answers are stored only in your browser. Don't enter passwords, keys, or other people's personal data.