Breach-Response Runbook Template

One page, two columns: the first-hour response (detect, contain, preserve, convene) and the 60-day clock (four-factor risk assessment, who to notify at 500+, business-associate and FTC paths), plus the one test to settle before launch.