Cybersecurity Compliance Toolkit: Written Information Security Programs, Risk Assessments, and Incident Disclosure Memos

Summary. This toolkit supplies the working documents of a cybersecurity compliance program and of the disclosure decisions that follow an incident. It provides an applicability memo, a written information security program skeleton with model clauses, a Qualified Individual designation, a risk assessment method with a risk register and a risk acceptance form, a control crosswalk keyed to the FTC Safeguards Rule, NYDFS Part 500, the HIPAA Security Rule, and the Massachusetts regulation, and a set of vendor security clauses. For governance it adds a board report outline with model minutes and an NYDFS certification support file; for incidents it supplies a timestamped determination log, counsel-directed forensic engagement terms, regulator notice outlines, a materiality memo for Form 8-K Item 1.05, model Item 1.05 and Item 8.01 language, an Item 106 drafting worksheet, and a tabletop exercise script. Each template states its purpose, owner, and timing and is followed by drafting notes tied to the governing rules and to the leading cases, including Wyndham, LabMD, Premera, Basic, and the Delaware oversight decisions. A closing section shows how examiners, plaintiffs, acquirers, and defense counsel use the same documents from the other side. The toolkit reflects the law as of February 2025, when the proposed HIPAA Security Rule overhaul was open for comment and the SEC's SolarWinds case was still pending.

The first document request in a cybersecurity investigation rarely mentions firewalls. It asks for the written information security program, the last two risk assessments, the board reports, the vendor contracts, and a timeline showing when the company knew what and when it decided what. Companies that can produce those papers end up arguing about judgment calls. Companies that cannot end up arguing about whether they had a program at all.

The short answer

The major American security regimes (the FTC's Safeguards Rule, New York's Part 500, the HIPAA Security Rule, the state statutes, and the SEC's disclosure rules) are enforced largely through documents. Examiners test a program by reading what the company wrote before an incident and what it recorded during one. The templates below are the documents that carry the most weight: a scoping memo, the written program, the risk assessment and its register, the board report and certification file, and, when something goes wrong, the determination log, the regulator notices, and the materiality memo that decides whether a public company files a Form 8-K. Write each one as if an examiner, a plaintiff's lawyer, and a juror will read it, because sooner or later one of them will.

How to use this toolkit

The sixteen templates follow the life of a program: scoping and the written program (Templates 1 to 3), risk assessment and controls (Templates 4 to 6), vendors (Template 7), governance and certification (Templates 8 and 9), and incidents and disclosure (Templates 10 to 16). A closing section shows how examiners, plaintiffs, acquirers, and defense counsel use the same documents from the other side. Each template opens with its purpose, its owner, and when to use it, and ends with drafting notes. Bracketed text is a placeholder. None of this is a form to adopt unchanged: a program document that describes controls the company does not actually run is worse than no document, because it turns a security lapse into a misrepresentation.

Privileged or not. Most of these documents should be ordinary business records, created because the law requires them and kept to prove that the program worked. The scoping memo's conclusions, the risk assessment, the register, the board report, the certification file, and the incident log belong in that group; assume they will be produced. Two templates are built for privilege from the outset: the forensic engagement terms (Template 11) and counsel's legal analysis in the materiality memo (Template 13). Even there, the underlying facts and the timeline are not privileged.

Where the law stands (February 2025). The FTC's amended Safeguards Rule, 16 C.F.R. Part 314, has applied in full since June 2023, and its requirement to notify the FTC of notification events involving 500 or more consumers took effect on May 13, 2024 (86 Fed. Reg. 70,272; 88 Fed. Reg. 77,499). New York's amended cybersecurity regulation, 23 NYCRR Part 500, took effect November 1, 2023 and is still phasing in: further access, scanning, and Class A requirements apply from May 1, 2025, and universal multi-factor authentication and the full asset inventory requirement from November 1, 2025. The next Part 500 annual filing, covering calendar year 2024, is due April 15, 2025. The SEC's 2023 rules (88 Fed. Reg. 51,896) have governed Form 8-K incident reports since December 18, 2023 (June 15, 2024 for smaller reporting companies), and calendar-year companies are now drafting their second annual Item 106 disclosure. In SEC v. SolarWinds Corp., 741 F. Supp. 3d 37 (S.D.N.Y. 2024), the court dismissed most of the SEC's claims in July 2024 but let fraud claims based on the company's website security statement proceed; the case remains pending. HHS published a proposed overhaul of the HIPAA Security Rule on January 6, 2025 (90 Fed. Reg. 898), with comments due March 7, 2025; it is a proposal, not law. The SEC's 2024 amendments to Regulation S-P, 17 C.F.R. Part 248, carry compliance dates of December 3, 2025 for larger entities and June 3, 2026 for smaller ones. CISA's proposed rule under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), 6 U.S.C. § 681b, is not yet final, and neither is the DFARS rule that will put the CMMC program, 32 C.F.R. Part 170 (effective December 16, 2024), into defense contracts. New leadership took over at both the FTC and the SEC in January 2025. Enforcement priorities may shift, but the rules above bind until they are changed.

For the law behind each template, see Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws. For the order in which to build the program, see Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide. For an item-by-item audit, use the Cybersecurity Regulatory Compliance Checklist: A Practical Checklist.

Template 1: Applicability and scoping memo

Purpose. Decide in writing which security regimes apply to which entities, and record the basis, so the program is built to the right requirements and the scoping decisions can be defended later. Owner. In-house or outside counsel, with the compliance lead and the CISO. When to use. At program launch; annually; and on any acquisition, new license, new product line, listing, or entry into a regulated sector.

To: [Program steering committee] From: [Counsel] Date: [ ] Re: Cybersecurity laws applicable to [Company] and its subsidiaries Entities reviewed: [list, with licenses, charters, registrations, and listings]

Drafting notes.

• The FTC Act covers nearly everyone. Unfairness requires substantial consumer injury that consumers cannot reasonably avoid and that is not outweighed by countervailing benefits, 15 U.S.C. § 45(n). The Third Circuit held that the standard reaches data security practices and that the FTC's published guidance and earlier complaints gave fair notice of what it requires, FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015).
• Record the activity, not the label. "Financial institution" turns on whether the business engages in activities that are financial in nature, 15 U.S.C. § 6809(3), as described in the Bank Holding Company Act, 12 U.S.C. § 1843(k). That is why auto dealers that arrange financing or leases, mortgage brokers, tax preparers, and many fintech companies are covered. The statute's safeguarding mandate is 15 U.S.C. § 6801(b), and the FTC enforces it against financial institutions outside the jurisdiction of the banking agencies, the securities and commodities regulators, and state insurance authorities, 15 U.S.C. § 6805.
• The small-institution exception is narrow. An institution holding customer information on fewer than 5,000 consumers is excused from four elements only: the written risk assessment, the continuous monitoring or penetration testing requirement, the written incident response plan, and the annual board report (16 C.F.R. § 314.6). Everything else, including MFA and encryption, still applies.
• Count affiliates. Part 500's Class A and limited-exemption thresholds include affiliates, and an entity claiming a limited exemption must file a notice of exemption with the Department.
• Repeat the memo when the facts change. A memo concluding "not a financial institution," written before the company launched a buy-now-pay-later product, is the kind of document that ends a defense.

Template 2: Written information security program skeleton

Purpose. The umbrella document that describes the program, satisfies the regimes that require a written program, and points to the policies, standards, and records that implement it. Owner. The Qualified Individual or CISO drafts it, counsel reviews it, and a senior officer or the board approves it. When to use. At launch; reviewed at least annually and whenever a material change in the business, its technology, or its risks occurs.

Skeleton, with model language for the sections examiners read first.

1. Purpose and objectives.

   [Company] maintains this Written Information Security Program to protect the security, confidentiality, integrity, and availability of the information described in Section 2; to protect against anticipated threats or hazards to that information; and to protect against unauthorized access to or use of it that could result in harm to customers, employees, or the Company.

2. Scope. Entities; information categories (customer information under the Safeguards Rule, nonpublic information under Part 500, electronic protected health information, personal information under 201 CMR 17.02, and confidential business information); systems, including cloud and vendor-hosted systems; locations; personnel.
3. Roles. The Qualified Individual or CISO (Template 3); the senior officer who oversees the program; the board committee; system and data owners; all personnel.
4. Risk assessment. The method and frequency (Template 4).
5. Safeguards. A summary of each control standard with a pointer to the governing policy: access control and least privilege, asset and data inventory, encryption, secure development, multi-factor authentication, retention and disposal, change management, logging and monitoring, physical security, endpoint protection and patching, and backups.

   All individuals accessing any Company information system must use multi-factor authentication. Any exception requires the Qualified Individual's written approval of reasonably equivalent or more secure access controls, recorded under Section 11.

6. Service providers. Selection, contract terms, and periodic assessment (Template 7).
7. Personnel. Training, background checks, acceptable use, discipline for violations, and prompt removal of access when employment ends.
8. Testing and monitoring. Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months; the internal audit plan.
9. Incident response. A pointer to the incident response plan.

   The Company will document each security incident, the actions taken in response, and the results of a post-incident review, including any resulting changes to business practices.

10. Board reporting. Content and frequency (Template 8).
11. Exceptions and risk acceptance. The process in Template 5.
12. Review and amendment.

    The Qualified Individual will review this Program at least annually and upon any material change in operations, business arrangements, or information systems, and will present proposed changes to [the senior officer or committee] for approval.

13. Records. Version history, approvals, and retention periods.

Drafting notes.

• Map each regime to a section. The Safeguards Rule allows a program "written in one or more readily accessible parts," so a short WISP that points to attached policies is fine (16 C.F.R. § 314.3(a)). Part 500 requires written policies approved at least annually by a senior officer or the board. Massachusetts requires a comprehensive WISP from anyone who owns or licenses a resident's personal information, with the program elements in 201 CMR 17.03(2) and the computer controls in 17.04. HIPAA requires written policies and six-year retention of the documentation, 45 C.F.R. § 164.316(b).
• Write what you do. The FTC treats security promises a company does not keep as deception, and the privacy policy's security claims were part of the Wyndham case. A WISP that says "MFA for all users" while the help desk keeps twenty exempt accounts is a prepared exhibit. For aligning public statements with the program, see Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC.
• Use the FTC's orders as a specification. After LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018), which vacated an order because it commanded "reasonable" security without saying what that meant, FTC orders itemize the safeguards they require. The 2023 orders against Drizly and Chegg, the 2024 Blackbaud order, the Marriott settlement announced in October 2024, and the proposed GoDaddy order announced in January 2025 among them call for data retention schedules, MFA, encryption, access controls, and independent assessments. The Drizly order also binds its chief executive personally, for ten years, at future companies he leads that collect consumer data.
• State hooks. A Massachusetts breach notice to the Attorney General must say whether the company maintains a WISP (M.G.L. c. 93H, § 3(b)). New York's SHIELD Act treats compliance with GLBA, HIPAA, or Part 500 as satisfying its reasonable safeguards requirement and lists administrative, technical, and physical safeguards that track this skeleton (N.Y. Gen. Bus. Law § 899-bb). California requires reasonable security (Cal. Civ. Code § 1798.81.5) and allows statutory damages when a breach results from its absence (§ 1798.150).
• Keep every version. Store each approved version with its approval date. The first question after an incident is which version was in force that day.

Template 3: Qualified Individual and CISO designation

Purpose. Name the accountable person in writing, define authority and reporting lines, and satisfy each regime's designation requirement. Owner. The board or a senior officer; counsel drafts. When to use. At launch; on any change in the role; whenever the role is outsourced to a virtual CISO or an affiliate.

RESOLVED, that [Name], [Title], is designated as the Company's Qualified Individual under 16 C.F.R. § 314.4(a)[, as its Chief Information Security Officer under 23 NYCRR § 500.4][, and as its security official under 45 C.F.R. § 164.308(a)(2)], responsible for overseeing, implementing, and enforcing the Company's information security program;

RESOLVED FURTHER, that the Qualified Individual shall have authority to approve security standards, require remediation of identified risks, suspend access, and escalate any matter directly to the [Committee], and shall report in writing to the [Board or Committee] at least annually and promptly upon any material cybersecurity issue;

RESOLVED FURTHER, that [if the role is outsourced] [Senior officer] is designated to direct and oversee [Provider]'s performance of the role, the Company retains responsibility for compliance, and [Provider] shall maintain an information security program that protects the Company as 16 C.F.R. Part 314 requires; and

RESOLVED FURTHER, that [Name] is designated to act in the role during any absence or vacancy.

Drafting notes.

• Outsourcing has three conditions. A service provider or affiliate may fill the role only if the company retains responsibility for compliance, designates a senior member of its own personnel to direct and oversee the Qualified Individual, and requires the provider to maintain a compliant program, 16 C.F.R. § 314.4(a). The third resolution tracks all three.
• Authority must be real. Part 500 defines the CISO as a qualified individual with adequate authority to ensure that cyber risks are appropriately managed, including the ability to direct sufficient resources. Authority on paper with no budget line reads badly in an examination.
• The title carries personal exposure. Part 500 requires the CISO to co-sign the annual filing; the SEC charged SolarWinds' CISO personally in a case still pending as of this writing; and a federal jury convicted Uber's former chief security officer in 2022 of crimes arising from concealing a breach from the FTC. In Delaware companies, officers owe an oversight duty within their areas of responsibility (In re McDonald's Corp. Stockholder Derivative Litigation, 289 A.3d 343 (Del. Ch. 2023)). Check that the D&O program covers the role; see Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice.

Template 4: Risk assessment method and risk register

Purpose. A written assessment that meets the Safeguards Rule's three required criteria, Part 500's annual review requirement, and HIPAA's risk analysis standard, plus a register that turns the assessment into decisions with owners and due dates. Owner. The Qualified Individual or CISO, with system and data owners; counsel reviews the method and every risk acceptance. When to use. Annually; on any material change (a new system, an acquisition, a cloud migration, a new product); after a significant incident; and when a new rule or proposal changes expectations.

A. Method statement (one page).

1. Scope: all systems and service providers that store, process, or transmit covered information, taken from the asset and data inventory dated [ ].
2. Inputs: the inventory; threat intelligence; vulnerability scans; penetration test results; audit findings; incident history; a gap analysis against [NIST CSF 2.0 or CIS Controls v8.1].
3. Likelihood scale (1 to 5), with written definitions (for example, 5 means the event is expected within twelve months or has already occurred in our environment).
4. Impact scale (1 to 5), with separate criteria for confidentiality, integrity, and availability, each measured by financial, operational, regulatory, customer-harm, and reputational effect (for example, 5 means exposure of more than [100,000] records or loss of a critical system for more than [48] hours).
5. Rating: likelihood times impact; 15 to 25 is high, 8 to 14 medium, 1 to 7 low.
6. Treatment: mitigate (owner and due date), transfer (insurance or contract), avoid (stop the activity or delete the data), or accept (Template 5). Acceptance authority rises with the rating: system owner for low, Qualified Individual for medium, senior officer with committee notice for high.
7. Reassessment triggers and distribution of results.

B. Risk register (extract).

Drafting notes.

• Required content. The Safeguards Rule requires a written assessment containing criteria for evaluating and categorizing risks, criteria for assessing confidentiality, integrity, and availability (including the adequacy of existing controls), and requirements describing how each risk will be mitigated or accepted, 16 C.F.R. § 314.4(b). Items 3 to 6 of the method statement are those criteria. Part 500 requires review and update at least annually and whenever a business or technology change causes a material change in cyber risk (§ 500.9).
• HIPAA. The Security Rule requires "an accurate and thorough assessment" of risks to all electronic protected health information, followed by risk management, 45 C.F.R. § 164.308(a)(1)(ii)(A). OCR began announcing settlements under a risk analysis enforcement initiative in late 2024, and the January 2025 proposal would make a written technology asset inventory and network map required inputs. See the HIPAA Security Rule Risk Analysis Checklist: A Practical Checklist.
• Method references. NIST SP 800-30 Revision 1 remains the standard method guide. NIST CSF 2.0 (February 2024) added a Govern function that maps onto board reporting. A quantitative method such as FAIR helps rank spending once the qualitative register exists.
• The rows are not random. R-04 is the Drizly fact pattern: credentials left in a code repository. R-03 tests the Safeguards Rule's disposal requirement, which calls for disposal no later than two years after the information was last used to serve the customer unless a stated exception applies (§ 314.4(c)(6)). Deleting stale data is often the cheapest risk reduction available; see Data Minimization and Avoiding the Over-Retention of Personal Information.
• Write the treatment column for a cost-benefit reader. Wyndham describes the unfairness inquiry as weighing the probability and expected size of harm to consumers against the cost of better security, Wyndham, 799 F.3d 236. A register showing that a fix was cheap and still not made is a liability document. The company can offer the register as a business record under Fed. R. Evid. 803(6) to show that the program worked, and an opponent can offer it as the company's own statement under Fed. R. Evid. 801(d)(2). A high risk left "open" for two years without a signed acceptance is the best exhibit a plaintiff can find.

Template 5: Risk acceptance and exception form

Purpose. A signed, time-limited record of any decision to accept a risk or depart from a policy or required control, with the compensating controls that justify it. Owner. The requesting system owner completes it; the Qualified Individual or CISO approves; a senior officer approves any high residual risk. When to use. Whenever a control cannot be implemented on schedule, a policy exception is needed, or a risk will be accepted rather than mitigated.

Exception or acceptance no.: [ ] Risk register ID: [ ] Requirement or policy affected: [for example, MFA for all users, 16 C.F.R. § 314.4(c)(5); encryption at rest, § 314.4(c)(3)] Description and business reason: [ ] Systems, data, and number of users or records affected: [ ] Compensating controls (specific and verifiable): [ ] Residual risk rating: [ ] Expiration (no more than twelve months): [ ] Remediation plan and milestones: [ ] Requested by: [name, date] Approved by Qualified Individual or CISO: [signature, date] Senior officer approval (required if residual risk is high): [signature, date] Reported to [Committee] on: [date] Review history: [ ]

Drafting notes.

• Two elements demand written approval. Under the Safeguards Rule, an alternative to MFA must be "reasonably equivalent or more secure" and approved in writing by the Qualified Individual (§ 314.4(c)(5)), and compensating controls for customer information that cannot feasibly be encrypted must be reviewed and approved by the Qualified Individual (§ 314.4(c)(3)). Part 500 likewise requires the CISO's written approval of compensating controls for MFA and encryption, with periodic review. An approval that lives only in an email thread is hard to find and easy to attack.
• Expiration forces a new decision. A permanent exception is a policy change; present it to the approver of the policy as one.
• High residual risks go to the board. Under Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), directors must make a good-faith effort to put a board-level reporting system in place for mission-critical risk, and under Stone v. Ritter, 911 A.2d 362 (Del. 2006), liability follows only from an utter failure to implement such a system or a conscious failure to monitor it. An acceptance file that was reported to the committee and discussed there is the opposite of conscious disregard.

Template 6: Control crosswalk and evidence index

Purpose. One table that shows, for each control area, which rule requires it and what evidence proves it operates, so a company subject to several regimes builds one program and can answer any examiner from the same file. Owner. The compliance lead, with the Qualified Individual. When to use. When building the program, before each certification or examination, and as the index to the evidence file.

Drafting notes.

• Build to the strictest common denominator. Where the rules differ, the stricter rule usually becomes the company standard: the Safeguards Rule already requires MFA for anyone accessing any information system, Part 500 will require the same from November 1, 2025, and the current HIPAA rule does not specify an authentication method. Running two standards for two regulators is more expensive than running the stricter one everywhere.
• Add a framework column (a NIST CSF 2.0 category, a CIS Control, or an ISO/IEC 27001 Annex A control) if the company reports against a framework. Frameworks do not create legal duties, but regulators, insurers, and courts use them to measure what "reasonable" means.
• Index evidence, not policies. Examiners ask for proof that controls operated during the period: the quarterly access review with sign-offs, not the access control policy. Keep the evidence file current, because assembling it after a document request arrives is how gaps become findings.
• HIPAA's "addressable" specifications are not optional. A covered entity must implement them where reasonable and appropriate or document why not and what it does instead. The January 2025 proposal would remove the distinction altogether. For the HIPAA regime generally, see HIPAA Privacy and Security Compliance for Covered Entities and Business Associates.

Template 7: Vendor security clauses

Purpose. Contract terms that let the company meet its own oversight duties and its own reporting clocks when a vendor holds its data or runs its systems. Owner. Procurement and legal, with the vendor risk manager. When to use. Every new contract with a vendor that touches covered information or critical systems; at renewal; after a vendor incident.

7.1 Security program. Vendor shall implement and maintain a written information security program containing administrative, technical, and physical safeguards appropriate to Vendor's size and complexity, the nature of the Services, and the sensitivity of Customer Data, and no less protective than Schedule [S] and applicable law.

7.2 Specific controls. Without limiting Section 7.1, Vendor shall (a) require multi-factor authentication for all access to systems that store, process, or transmit Customer Data; (b) encrypt Customer Data in transit over external networks and at rest; (c) limit access to personnel who need it to perform the Services and review that access at least [quarterly]; (d) log access to Customer Data and retain the logs for at least [twelve] months; and (e) remediate critical vulnerabilities within [fifteen] days.

7.3 Security incidents. Vendor shall notify Customer at [security contact] without undue delay, and in any event within [24] hours, after becoming aware of any actual or reasonably suspected unauthorized access to, or acquisition, disruption, or misuse of, Customer Data or any system Vendor uses to provide the Services (a "Security Incident"). Vendor shall provide the information Customer reasonably requests to meet its legal obligations, supplement it as facts develop, preserve relevant logs and forensic images, and cooperate with Customer's investigation. Vendor shall not notify regulators or affected individuals regarding Customer Data without Customer's prior written consent, except as required by law.

7.4 Assessments. Vendor shall deliver annually a SOC 2 Type II report or ISO/IEC 27001 certificate covering the Services, a summary of its most recent penetration test, and responses to Customer's security questionnaire, and shall permit Customer or its designee to assess relevant controls after any Security Incident or at a regulator's request.

7.5 Subcontractors. Vendor shall impose obligations at least as protective as this Section on every subcontractor with access to Customer Data, shall remain responsible for their performance, and shall give [30] days' notice before a new subcontractor accesses Customer Data.

7.6 Regulators. Vendor shall make information and personnel reasonably available to Customer's regulators upon request.

7.7 Return and deletion. On termination or request, Vendor shall return or securely delete Customer Data and certify the deletion in writing, except where law requires retention.

7.8 Allocation of loss. Vendor's liability for breach of this Section and for Security Incidents [is excluded from the limitation of liability in Section ] [is subject to a separate cap of $] and includes the reasonable costs of investigation, notification, credit monitoring, call centers, regulatory fines and penalties to the extent the law allows, and amounts payable to card networks or other third parties.

Drafting notes.

• The rules require contract terms. The Safeguards Rule requires selecting capable providers, requiring safeguards by contract, and periodically reassessing them (§ 314.4(f)). Part 500 requires a written third-party policy covering due diligence and contract terms on access controls, encryption, and incident notice (§ 500.11). HIPAA requires business associate agreements with security terms (45 C.F.R. § 164.314(a)), and business associates are directly subject to the Security Rule, 42 U.S.C. § 17931. Massachusetts requires both diligence and contract terms (201 CMR 17.03(2)(f)). Amended Regulation S-P will require covered firms to ensure their service providers give notice within 72 hours.
• Why 24 hours. NYDFS's 72-hour clock runs from the covered entity's determination that an incident occurred, including one at a third-party service provider. The SEC defines a registrant's information systems to include resources "owned or used by" it, 17 C.F.R. § 229.106(a), so a vendor's incident can be the registrant's incident. A vendor clause that matches the regulator's 72 hours leaves the company no time. Banks start with a floor: a bank service provider must notify its bank customers as soon as possible when an incident disrupts or degrades covered services for four or more hours, 12 C.F.R. Part 53.
• Carve-outs decide who pays. In Schnuck Markets, Inc. v. First Data Merchant Services Corp., 852 F.3d 732 (8th Cir. 2017), the processor could not recover card-network assessments for issuer losses beyond a $500,000 cap, because the court read those assessments as falling outside the carve-outs for "third party fees" and "fees, fines or penalties." Name the categories of loss expressly, on whichever side of the table you sit.
• Vendors push back on 7.4 and 7.8 first. A reasonable compromise is a super-cap sized to the data at stake and audit rights limited to post-incident and regulator-driven reviews. For diligence questions, see the Vendor Cybersecurity Diligence Checklist: A Practical Checklist; for the program around the clauses, Building a Vendor and Third-Party Risk Management Program; for cloud terms, Cloud and SaaS Agreements: Service Levels, Data Rights, Security, and Exit.

Template 8: Annual board report and model minutes

Purpose. The Qualified Individual's or CISO's annual written report to the board, and minute language that records real oversight. Owner. The Qualified Individual or CISO drafts the report; the corporate secretary or general counsel drafts the minutes; the committee chair reviews both. When to use. At least annually, with shorter quarterly updates, and promptly when a material issue arises.

Report outline.

1. One-page summary: overall status of the program and compliance with each applicable rule; the top five risks and their trend; decisions requested from the board.
2. Risk assessment: changes since the last report, new high risks, and acceptances granted (Template 5).
3. Risk management and control decisions: major investments, MFA and encryption coverage, open exceptions.
4. Service providers: critical vendors, assessment results, and incidents at vendors.
5. Testing: penetration test and scan findings by severity and age, audit findings, and retest results.
6. Security events and management's responses: incidents, near misses, notices given, regulator contacts.
7. Metrics: MFA coverage; median time to patch critical vulnerabilities; high findings open more than 90 days; phishing simulation failure rate; backup restoration test results; overdue vendor reassessments.
8. Resources: budget, staffing, and gaps.
9. Regulatory developments: for 2025, the remaining Part 500 phases (May 1 and November 1), the HIPAA proposal, Regulation S-P compliance dates, and CIRCIA.
10. Recommended changes to the program.

Model minutes.

The Committee received the Qualified Individual's written annual report on the information security program dated [date], which was distributed to members on [date]. [Name], CISO, reviewed the program's status and compliance, the results of the [year] risk assessment, the three risks rated high and the treatment plan for each, the results of the [month] penetration test, and two security events during the period, neither of which required regulatory notice. Members asked about [the schedule for MFA on the legacy servicing platform] and [the call-center vendor's remediation]. The Committee directed management to [complete the MFA rollout by (date)] and to report on progress at the [next] meeting, and [approved / recommended that the Board approve] [additional funding of $__]. The Committee then met in executive session with the CISO, without other members of management present.

Drafting notes.

• Required content. The Safeguards Rule requires a written report, "regularly and at least annually," on the overall status of the program and the institution's compliance, and on material matters including the risk assessment, risk management and control decisions, service provider arrangements, test results, security events and management's responses, and recommended changes, 16 C.F.R. § 314.4(i). Part 500 requires the CISO's annual written report and timely reports of material issues, and requires the board to have enough understanding of cybersecurity to exercise oversight (§ 500.4). Sections 1 to 6 and 10 of the outline track the federal list.
• The minutes are the defense. Directors must make a good-faith effort to ensure that a reporting system exists, In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). The Marriott directors won dismissal because the record showed the board and audit committee were routinely briefed on cyber risk, Firemen's Retirement System of St. Louis v. Sorenson, C.A. No. 2019-0965-LWW (Del. Ch. Oct. 5, 2021), and the SolarWinds directors won because the plaintiffs pleaded neither the absence of a reporting system nor red flags the board ignored, Construction Industry Laborers Pension Fund v. Bingle, No. 411, 2022 (Del. May 17, 2023) (affirming the Court of Chancery's dismissal). Minutes that record questions, directions, and follow-up are what those courts read.
• Match the 10-K. A public company's Item 106 governance description must be true of the minutes (Template 15).
• Keep privileged advice separate. Record that "counsel provided legal advice regarding [topic]" and keep counsel's materials in a separate privileged file. For mechanics, see the Board Meeting and Minutes Checklist: A Practical Checklist; for the duties, Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight.

Template 9: NYDFS annual certification support file

Purpose. Assemble the evidence and sub-certifications that let the two signers file a truthful Part 500 certification of material compliance, or a truthful acknowledgment of noncompliance. Owner. The CISO and the compliance lead assemble it; counsel reviews; the highest-ranking executive and the CISO sign. When to use. Start in January for the prior calendar year. The filing covering 2024 is due April 15, 2025.

Contents.

1. Decision memo. For each section of Part 500: the requirement, its effective date during the year, its status, the evidence reference (Template 6), and any gap. Conclude: certification or acknowledgment.
2. Sub-certifications from control owners.

   I am responsible for the controls listed in Schedule A. For the period January 1 through December 31, [2024], after reasonable inquiry, I believe those controls operated as described in the Company's policies, except as stated in Schedule B. I have provided the documentation listed in Schedule C. [Signature, date]

3. Evidence index, organized by section.
4. If acknowledging noncompliance: each section not materially complied with, the nature and extent of the noncompliance, and a remediation timeline or confirmation that remediation is complete.
5. Signature page and portal confirmation.
6. Retention note: keep the file, with all supporting records, for five years.

Drafting notes.

• The amended rule offers a choice. Each April 15, a covered entity files either a certification that it materially complied during the prior calendar year, based on data and documentation sufficient to demonstrate it, or an acknowledgment of noncompliance that identifies every section missed, describes the noncompliance, and gives a remediation timeline. Both must be signed by the highest-ranking executive and the CISO (23 NYCRR § 500.17(b)).
• Certify facts, not plans. NYDFS consent orders have charged improper certifications as separate violations. If a requirement was not met for a material part of the year, acknowledge it; the acknowledgment exists for exactly that situation.
• Watch the phase-in dates. Requirements that took effect on April 29, 2024 and November 1, 2024 must be assessed from their effective dates in the 2024 filing.
• Sub-certifications do not shift responsibility, but they make the signers' inquiry reasonable and documented, much as sub-certifications support the CEO and CFO certifications that Sarbanes-Oxley section 302 requires, 15 U.S.C. § 7241.

Template 10: Incident determination and clock log

Purpose. A contemporaneous, timestamped record of what the company knew, who decided what, and which legal clock each decision started. Owner. A scribe named in the incident response plan, supervised by counsel; the decision-makers confirm each entry. When to use. From the first escalation of any security event until the incident file is closed.

Example: Quillfeather Lending, Inc. (a Nasdaq-listed consumer lender holding a New York lender license; all times Eastern; January 2025).

Add rows for state breach notices, customer contract notices, the cyber insurer, law enforcement contacts, and every update to a regulator.

Drafting notes.

• Each clock has its own trigger. NYDFS runs from the determination that a cybersecurity incident occurred. The FTC runs from discovery, which is the first day the event is known to any employee, officer, or agent other than the attacker, and unauthorized access to unencrypted customer information is presumed to be acquisition unless the company has reliable evidence otherwise (16 C.F.R. § 314.4(j); § 314.2(m)). That is why row 2 starts the FTC clock before exfiltration was confirmed. The SEC runs from the materiality determination, which must be made without unreasonable delay after discovery. HIPAA and most state statutes run from discovery.
• Record facts, times, and names. Use one time zone, and record who made each determination and on what facts. Regulators reconstruct timelines from tickets and emails; a contemporaneous log is better evidence than a reconstruction, and its absence invites the worst inference.
• Keep it factual. Put legal analysis in counsel's memos and only facts here; assume the log will be produced.
• Preserve. Issue a litigation hold once litigation is reasonably anticipated; loss of electronically stored information that should have been preserved can draw sanctions under Fed. R. Civ. P. 37(e). Defense contractors must also preserve images for 90 days under DFARS 252.204-7012, 48 C.F.R. Part 252. See the Litigation Hold and Evidence Preservation Checklist: A Practical Checklist, and for the response itself, Responding to a Data Breach: The First Seventy-Two Hours.

Template 11: Counsel-directed forensic engagement terms

Purpose. Engagement terms that give the forensic investigation the best available chance of attorney-client privilege and work-product protection. Owner. Outside breach counsel drafts; the general counsel approves; the forensic firm countersigns. When to use. Negotiate the terms in advance, with the firm on retainer, and sign the incident-specific letter in the first hours of a significant incident.

1. Engagement by counsel. [Law Firm] ("Counsel") engages [Forensic Firm] ("Consultant") to assist Counsel in providing legal advice to [Client] concerning [the incident detected on (date)], including advice about litigation and regulatory proceedings that Counsel reasonably anticipates.
2. Separate scope. This engagement is separate from any existing agreement between Consultant and Client. Consultant will perform only the work Counsel directs under this letter. Containment, remediation, and restoration services, if any, will be performed under a separate statement of work with Client.
3. Direction and reporting. Consultant will take direction from Counsel, report to Counsel, and deliver all findings, drafts, and reports only to Counsel.
4. Distribution. Consultant will not share its work with anyone other than Counsel and persons Counsel designates in writing.
5. Billing. Consultant will invoice Counsel [or invoice Client, addressed to Counsel], and Client will record the fees as legal expenses from the outset.
6. Marking and preservation. Consultant will mark its materials "Privileged and Confidential; Attorney Work Product; Prepared at the Direction of Counsel," will preserve images, logs, and other evidence with chain-of-custody records, and will retain them until Counsel releases them in writing.
7. Government communications. Nothing in this letter prohibits any person from communicating with a government agency about a possible violation of law.

Drafting notes.

• The tests. The privilege protects communications made to obtain legal advice, including employees' communications with corporate counsel, but not the underlying facts, Upjohn Co. v. United States, 449 U.S. 383 (1981). In the D.C. Circuit it is enough that obtaining legal advice was "one of the significant purposes" of an internal investigation, even one that a regulation required, In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014). Work product covers documents prepared in anticipation of litigation, Fed. R. Civ. P. 26(b)(3), and many courts deny protection to a document that would have been created in substantially similar form anyway.
• Where protection failed. In In re Premera Blue Cross Customer Data Security Breach Litigation, 296 F. Supp. 3d 1230 (D. Or. 2017), the forensic firm had been hired by the company before counsel arrived, and an amended statement of work changed only who supervised it, not what it did. In In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), the firm worked under a pre-existing retainer with essentially the same scope, and the report went to dozens of employees, regulators, and the company's outside accountants. In Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021), the report was shared with Clark Hill's leadership, its IT team, and the FBI, and was the only place the company had recorded what happened, so the claimed second track did not exist in fact. Protection held in In re Target Corp. Customer Data Security Breach Litigation, 2015 WL 6777384 (D. Minn. Oct. 23, 2015), where a genuine business investigation ran separately from counsel's.
• Run two tracks in fact. Use one vendor (or the company's own team) for containment and remediation, without privilege, and a separately engaged firm for counsel's investigation. Give business teams factual summaries prepared for them, not the counsel report.
• Assume a regulator will ask. Most federal courts of appeals reject "selective waiver," so a report handed to a regulator should be presumed available to private plaintiffs. Offer an oral briefing or a factual summary first, and in litigation seek an order under Fed. R. Evid. 502(d).
• Clause 7 is not boilerplate. The SEC's Rule 21F-17 bars any action that impedes communication with the Commission about possible securities violations, 17 C.F.R. Part 240, and in 2024 the SEC settled with several public companies over employment and separation agreements that impeded or discouraged reporting to it. The same applies to confidentiality instructions given to employees during an incident.
• Check the policy. Cyber policies often require panel vendors and the insurer's consent to fees; see Placing and Tendering a D&O or Cyber Claim: A Practical Guide. For privilege doctrine generally, see Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest.

Template 12: Regulator notice outlines and the extortion payment record

Purpose. Pre-built outlines for the notices with the least familiar content requirements, so the facts can be dropped in from the determination log under pressure. Owner. Counsel drafts; the CISO supplies facts; the decision-maker named in the plan approves. When to use. Prepare in advance; complete during an incident.

A. FTC Safeguards Rule notice (online form on ftc.gov; as soon as possible and no later than 30 days after discovery; only for events involving 500 or more consumers). The rule fixes the content:

1. Name and contact information of the reporting institution.
2. The types of information involved.
3. The date or date range of the event, if it can be determined.
4. The number of consumers affected or potentially affected.
5. A general description of the event.
6. Whether a law enforcement official has given a written determination that notifying the public would impede a criminal investigation or damage national security, with a way for the FTC to contact that official.

B. NYDFS 72-hour notice (through the Department's portal). Have ready: the entity and license; a contact; the date and time of the determination; whether the incident occurred at the entity, an affiliate, or a third-party service provider; a description; affected systems; the nonpublic information involved and the number of New York residents; any ransomware deployment or extortion demand; law enforcement and other regulators notified; containment status; and the date of the next update.

C. Extortion payment record.

Demand received (date, time, amount, currency, deadline): [ ] Threat actor attribution and indicators: [ ] Sanctions screening of the actor, wallet addresses, and any intermediary against OFAC's lists and advisories (who, when, result): [ ] Law enforcement contacted (agency, date, reference): [ ] Insurer consent (date, adjuster): [ ] Alternatives considered (restoration from backups, available decryptors, rebuild) and why each was rejected: [ ] Approvals (name, title, time): [ ] Payment (date, method, intermediary): [ ] NYDFS 24-hour notice filed (time): [ ] 30-day written explanation due (date): [ ]

Drafting notes.

• FTC. The six content items and the law enforcement delay (an initial delay of up to 30 days, extendable by up to 60 more on written request) come from 16 C.F.R. § 314.4(j)(1). In adopting the requirement, the FTC said it intends to make these reports publicly available, which is why the rule asks about law enforcement delay. Write the description as if customers and plaintiffs will read it.
• NYDFS. The covered entity must also answer the Department's follow-up requests and keep updating its notice as facts develop (§ 500.17(a)). An extortion payment requires notice within 24 hours and, within 30 days, a written description of why payment was necessary, the alternatives considered, the diligence done to find alternatives, and the diligence done to comply with applicable law, including OFAC's rules (§ 500.17(c)). The record above collects exactly those facts as they happen.
• Sanctions. Liability for a payment to a sanctioned person is strict, 50 U.S.C. § 1705, and several ransomware actors and their facilitators have been designated, some under the cyber-related sanctions program, 31 C.F.R. Part 578. OFAC's September 2021 advisory says license applications for such payments face a presumption of denial and that prompt reporting to law enforcement, cooperation, and meaningful security measures count as mitigating factors under its Enforcement Guidelines, 31 C.F.R. Part 501. When CISA's CIRCIA rule takes effect, covered entities will also report ransom payments within 24 hours. See Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses.
• Other clocks. The bank 36-hour rule, the NCUA's 72 hours, DFARS's 72 hours, HIPAA's 60 days, the Health Breach Notification Rule (16 C.F.R. Part 318), the FCC's carrier rule (47 C.F.R. § 64.2011, expanded by a December 2023 order that is under review in the Sixth Circuit), and the state statutes are mapped in Part 8 of the checklist and Step 8 of the guide. Notices to individuals are covered in Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.

Template 13: Incident materiality memo

Purpose. Record the disclosure committee's analysis of whether a cybersecurity incident is material, the facts it relied on, when it decided, and the disclosure path it chose. Owner. Securities counsel or the general counsel drafts; the disclosure committee decides; the CISO supplies the facts; the audit committee chair is briefed. When to use. Open version 1 when an incident is first escalated to the committee; update it at every meeting and on every significant new fact until a final determination.

Privileged and Confidential; Attorney-Client Communication [use only if accurate] To: Disclosure Committee From: [Counsel] Version: [n], [date and time] Re: Materiality of incident [ID]

1. Question. Whether incident [ID] is a material cybersecurity incident requiring a report under Form 8-K Item 1.05 and, if not, what disclosure, if any, is appropriate.
2. Timeline: discovery, escalation, and meetings (from Template 10).
3. Facts known as of [time], with confidence levels: affected systems; data involved and volume; evidence of exfiltration; operational impact (systems down, duration, customers affected); threat actor and demand; containment status; involvement of any third party.
4. Open questions and when each is expected to be answered.
5. Quantitative factors: response and remediation costs; lost revenue; contract penalties and service credits; any ransom; expected regulatory and litigation costs; insurance recovery (shown separately, never netted); comparison with revenue, operating income, and guidance.
6. Qualitative factors: harm to reputation, customer or vendor relationships, and competitiveness; likelihood of litigation and regulatory investigation; sensitivity of the data; interruption of a flagship product; whether the incident reveals a weakness in controls described in earlier filings; whether it is one of a series of related incidents.
7. Probability and magnitude for facts still developing.
8. Consistency check: whether the incident makes any earlier statement inaccurate (risk factors written as hypothetical, the Item 106 description, the website security page, statements to customers).
9. Determination: material; not material; or not yet determinable, with the time of the next review. Give the reasons in three to five sentences.
10. Disclosure path: Item 1.05 (with the deadline computed to the day); Item 8.01; or no filing; and the effect of other notices (regulators, customers, state attorneys general) on when the incident will become public.
11. National security delay: whether to request one, and when the FBI was contacted.
12. Trading and selective disclosure: trading window, preclearance, review of Rule 10b5-1 plans, and Regulation FD.
13. Next steps and owners.

Drafting notes.

• The standard. A fact is material if there is a substantial likelihood that a reasonable investor would consider it important, as significantly altering the total mix of information, TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976). For contingent or developing events, weigh the probability of the event against its magnitude, Basic Inc. v. Levinson, 485 U.S. 224 (1988). There is no bright-line numerical test, Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27 (2011). The SEC's adopting release lists the qualitative factors in item 6, and the staff has said that the small size of a ransom, or the fact that an attack has ended, does not by itself make an incident immaterial.
• Timing. The determination must be made without unreasonable delay after discovery, and the report is due four business days after it. Form 8-K is prescribed by 17 C.F.R. § 249.308 under the reporting duty in 15 U.S.C. § 78m. The adopting release gives an example of unreasonable delay: intentionally deferring a committee meeting past the time it normally takes to convene. Do not wait for the forensic report. Disclose what is known, say what is not, and amend within four business days after the missing information is determined or becomes available.
• Aggregation. A "cybersecurity incident" includes "a series of related unauthorized occurrences," 17 C.F.R. § 229.106(a), so repeated small intrusions by the same actor through the same weakness may need to be assessed together.
• Fraud exposure. A late Item 1.05 report is not by itself a Rule 10b-5 violation, because the safe harbor in Exchange Act Rule 13a-11(c) extends to it, but misstatements remain actionable under 15 U.S.C. § 78j(b). A pure omission of information an SEC item requires is not actionable under Rule 10b-5(b), but a half-truth is, Macquarie Infrastructure Corp. v. Moab Partners, L.P., 601 U.S. 257 (2024). An opinion such as "we believe the incident is contained" can mislead if it omits facts about the basis for the belief, Omnicare, Inc. v. Laborers District Council Construction Industry Pension Fund, 575 U.S. 175 (2015).
• What the SEC has charged. In October 2024 the SEC settled with Unisys, Avaya, Check Point, and Mimecast over disclosures that allegedly minimized intrusions from the SolarWinds campaign or described them as hypothetical; two commissioners dissented. In SolarWinds, by contrast, the court dismissed the claims based on the company's post-attack Form 8-K while sustaining the claims based on its earlier website security statement. The exposure usually lies in what a company said before the incident.
• The memo is evidence either way. Counsel's analysis may be privileged, but the time of the determination and the facts the committee knew are not, and a company that defends its timing by relying on counsel's advice waives the privilege over that advice. Write every version knowing that SEC staff may read it.
• National security delay. Only the Attorney General can authorize a delay, by notifying the SEC in writing; the Department of Justice and FBI procedures issued in December 2023 ask companies to contact the FBI immediately upon the materiality determination. Until the SEC is notified, the four-day clock keeps running.
• Trading. Insiders at Equifax were charged with trading on knowledge of the 2017 breach before it was announced. Close the window when an incident is escalated, not when it is determined to be material. Regulation FD, 17 C.F.R. Part 243, governs disclosures to market professionals and securityholders; ordinary-course notices to customers generally fall outside it, but coordinate them so a customer notice is not the first public disclosure. See Running a Public Company Disclosure Program: A Practical Guide and the Securities Disclosure Toolkit: Policies, Blackout Calendars, and 10b5-1 Plans.

Template 14: Form 8-K language for Items 1.05 and 8.01

Purpose. Starting language for the two filing paths. Owner. Securities counsel, with the CISO verifying every factual statement. When to use. Pre-draft both versions during the tabletop (Template 16); finalize during an incident.

A. Item 1.05 (material incident).

Item 1.05. Material Cybersecurity Incidents. On [date], [Company] detected unauthorized activity on certain of its information technology systems[, including systems that support its loan servicing operations]. The Company activated its incident response plan, took steps to contain the activity, engaged external cybersecurity experts, and notified law enforcement. The Company has determined that an unauthorized third party [deployed ransomware that encrypted (description of systems) and] obtained copies of files containing [categories of personal information] relating to approximately [number] customers. [Describe the operations affected and for how long.] As of the date of this report, the incident has had, and is reasonably likely to continue to have, a material impact on the Company's operations[, including (describe)]. The Company has not yet determined the incident's impact on its financial condition and results of operations and will amend this report when that information is determined or becomes available. [Cautionary language regarding forward-looking statements.]

B. Item 8.01 (not determined to be material).

Item 8.01. Other Events. On [date], [Company] identified a cybersecurity incident involving [brief description]. [Response steps.] As of the date of this report, the incident has not had a material impact on the Company's operations, and the Company has not determined that the incident is material [or: has not yet determined whether the incident is material]. The Company continues to evaluate the incident.

Drafting notes.

• What Item 1.05 requires. The material aspects of the incident's nature, scope, and timing, and its material impact or reasonably likely material impact, including on financial condition and results of operations. It does not require technical detail about the response or vulnerabilities that would impede remediation. If information is not yet available, say so and amend within four business days after it is.
• Use Item 8.01 for everything else. In May 2024 the Director of the Division of Corporation Finance asked companies to reserve Item 1.05 for incidents determined to be material and to use Item 8.01 for voluntary disclosure of other incidents; if an incident disclosed under Item 8.01 is later determined to be material, file under Item 1.05 within four business days of that determination.
• Words to avoid. "No evidence" unless the investigation actually looked; "sophisticated" as a defense; and any description of something that has happened as a risk that "could" happen. Check the filing against notices to state attorneys general, which often become public, and against the website security page.
• Forward-looking statements about recovery and costs get the PSLRA safe harbor only with meaningful cautionary language, 15 U.S.C. § 78u-5, and the safe harbor never covers statements of present or historical fact.

Template 15: Item 106 drafting worksheet

Purpose. Tie every sentence of the Form 10-K cybersecurity disclosure to a document that proves it. Owner. Securities counsel drafts; the CISO, corporate secretary, and risk officer verify their rows. When to use. Each annual report cycle, and whenever an incident or a governance change makes the last description stale.

Drafting notes.

• The item. Item 106 requires a description of processes for assessing, identifying, and managing material cyber risks, whether risks from threats or past incidents have materially affected or are reasonably likely to materially affect the company, the board's oversight, and management's role and expertise, 17 C.F.R. § 229.106. Describe the program in plain words and nothing more; aspirational language belongs nowhere in it.
• Risk factors must keep pace with events. Warnings that present as hypothetical a risk that has already materialized can be misleading, In re Alphabet, Inc. Securities Litigation, 1 F.4th 687 (9th Cir. 2021); In re Facebook, Inc. Securities Litigation, 87 F.4th 934 (9th Cir. 2023). The Supreme Court granted review in Facebook and then, in November 2024, dismissed the writ as improvidently granted, leaving the Ninth Circuit's decision in place.
• Website statements count. The claims that survived in SolarWinds rested on a website security statement, while the court rejected the theory that weak cybersecurity violates the internal accounting controls provision, 15 U.S.C. § 78m(b)(2)(B). Reconcile the trust page with this worksheet; see the Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records.
• Disclosure controls carry the facts upward. Exchange Act Rule 13a-15 requires controls that get information to the people who make disclosure decisions (17 C.F.R. Part 240); the SEC's 2021 First American case turned on a vulnerability that security staff knew about and executives did not. See the Disclosure Controls and Insider Trading Checklist: A Practical Checklist.

Template 16: Tabletop exercise script and after-action record

Purpose. Test the plan, the people, and these documents against a realistic incident before a real one does. Owner. Counsel facilitates with the CISO; participants include the executives who make decisions, communications, and disclosure committee members. When to use. At least annually, after major changes, and before the first filing season under a new rule.

Script (90 minutes; Quillfeather facts).

1. Hour 0. The help desk reports lockouts; endpoint alerts show encryption on file servers. Who declares an incident? Who is the scribe for Template 10?
2. Hour 3. A ransom note appears; the servicing platform is down; unencrypted customer files sit on affected servers. Has a Part 500 incident occurred? Has the FTC clock started? Which engagement letter (Template 11) is signed, and by whom?
3. Day 1. The actor posts sample customer records; a reporter calls. Is the disclosure committee convened? Is the trading window closed? What does the holding statement say?
4. Day 2. The demand is $4 million in cryptocurrency, and backups are partly corrupted. Walk through Template 12C. Who screens for sanctions? Who calls the insurer?
5. Day 3. Forensics show the actor used a vendor's credentials. What do the vendor's contract terms require? Does the Item 106 description of vendor oversight still hold?

After-action record: date; participants and roles; scenario and objectives; what worked; gaps; corrective actions with owners and due dates, entered in the risk register; approval by the Qualified Individual.

Drafting notes.

• Testing is required. The Safeguards Rule requires regular testing of key controls and procedures and revision of the incident response plan after events (§ 314.4(d)(1), (h)(7)). Part 500 requires testing of the incident response and business continuity plans, and of restoration from backups, at least annually (§ 500.16). HIPAA calls for contingency plan testing and revision procedures, 45 C.F.R. § 164.308(a)(7)(ii)(D).
• Keep two records. Counsel's facilitation notes may be privileged; the after-action summary should not be, because it is the evidence regulators ask for. A participating board also builds its own Caremark record.
• Test the paper, too. The most common tabletop finding is that nobody can find the signed forensic engagement letter, the notice outlines, or the 8-K drafts at 3 a.m. Store them where the incident team can reach them when email is down.

Using these documents from the other side

The same papers serve every side of a cybersecurity dispute.

• Examiners and investigators. The FTC investigates by civil investigative demand, 15 U.S.C. § 57b-1, and NYDFS and state attorneys general ask for the same set: every WISP version, the last two risk assessments, the register, board reports and minutes, vendor contracts, penetration tests, the incident log, and certification files. See the Regulatory Investigations Toolkit.
• Plaintiffs. Requests under Fed. R. Civ. P. 34 target the register's open items, expired exceptions, and stale assessments, and a deposition of the company under Fed. R. Civ. P. 30(b)(6) asks the designee to explain each one. Securities plaintiffs compare the Item 106 text and risk factors with the internal record; see Securities Fraud Litigation Under Rule 10b-5: Elements, the PSLRA, and Defense Strategy.
• Acquirers. Diligence asks for the same documents, plus every incident and regulator contact in the last several years. Marriott's Starwood breach began before the acquisition and came with the deal.
• Defense counsel. These documents are also the defense: proof that the program existed, that risks were weighed against cost under 15 U.S.C. § 45(n), that the board was informed, and that disclosure decisions were made on time. Organize them before the first request arrives, and prepare the 30(b)(6) designee on the register line by line.

Frequently asked questions

We are a small company. Which templates do we need? Templates 1, 2, 3, 5, 7, and 10 at a minimum. A financial institution with customer information on fewer than 5,000 consumers is excused from the written risk assessment, the penetration testing and vulnerability assessment element, the written incident response plan, and the board report (16 C.F.R. § 314.6), but a simple version of each is still the best evidence of reasonable security under the FTC Act and state law.

Should the risk assessment and register be privileged? No. They are records the law requires, and they are most valuable as proof that the program worked. Counsel can commission a separate, privileged legal assessment of exposure, but should not try to cloak the required one.

Can we wait for the forensic report before deciding materiality? No. The determination must be made without unreasonable delay on the facts available. File what is known, say what is not, and amend.

Who signs the NYDFS filing, and what if we were not fully compliant? The highest-ranking executive and the CISO. If the company did not materially comply, it files an acknowledgment of noncompliance with a remediation timeline instead of a certification.

Should we rewrite our HIPAA documents for the January 2025 proposal? Not yet. It is a proposal open for comment until March 7, 2025. Use it to set priorities (an asset inventory, network map, MFA, and encryption are worth doing anyway) and revisit when a final rule appears.

How long should we keep these documents? At least six years for HIPAA documentation and five years for the Part 500 certification file; FTC orders typically impose their own recordkeeping terms; and a litigation hold overrides every schedule.

Practical takeaways

• Decide applicability in writing first; every other document depends on it.
• Write the program the company actually runs, and keep every approved version.
• Make the register the center of the program, and close every high risk with a fix or a signed, dated acceptance.
• Put the board's oversight in the minutes, with questions, directions, and follow-up.
• During an incident, log every determination with a time and a name; each clock has its own trigger.
• Engage the forensic firm through counsel on a genuinely separate track, and limit who receives its report.
• Write the materiality memo as if SEC staff will read it, and never let it sit in draft while the clock runs.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Companion documents in this series

• Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws: the law behind each template.
• Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide: the step-by-step build in which these documents are produced.
• Cybersecurity Regulatory Compliance Checklist: A Practical Checklist: an item-by-item audit of the program and every reporting clock.

Related Articles and Guides

• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: notice to individuals and state regulators.
• Responding to a Data Breach: The First Seventy-Two Hours: the operational response that Templates 10 to 12 document.
• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: keeping public security statements true.
• Drafting and Maintaining a Privacy Policy: A Practical Guide: the process for the public-facing statements regulators compare with the WISP.
• Running a Public Company Disclosure Program: A Practical Guide: the disclosure committee behind Templates 13 to 15.
• Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight: the oversight duty the board report documents.
• Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest: the doctrine behind Template 11.
• Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice: coverage for the incident and for the people who sign.
• Placing and Tendering a D&O or Cyber Claim: A Practical Guide: notice, consent, and panel vendors.
• Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses: the sanctions analysis behind a ransom decision.
• Securities Fraud Litigation Under Rule 10b-5: Elements, the PSLRA, and Defense Strategy: the litigation that follows a disclosure misstep.

Related Checklists

• Vendor Cybersecurity Diligence Checklist: A Practical Checklist: diligence before signing Template 7.
• HIPAA Security Rule Risk Analysis Checklist: A Practical Checklist: the HIPAA version of Template 4.
• Board Meeting and Minutes Checklist: A Practical Checklist: minute-taking mechanics for Template 8.
• Disclosure Controls and Insider Trading Checklist: A Practical Checklist: escalation and trading controls during an incident.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: preservation once litigation is foreseeable.

Related Toolkits

• Cybersecurity Program Toolkit: the technical program, stage by stage.
• Data Breach and Incident Response Toolkit: From Detection to Notification: response and notification templates.
• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: templates for the public statements regulators test against the program.
• Securities Disclosure Toolkit: Policies, Blackout Calendars, and 10b5-1 Plans: trading windows and disclosure policies.
• Compliance Program Toolkit: Risk Assessments, Testing Plans, and Remediation Records: risk registers and remediation tracking for compliance programs generally.
• Regulatory Investigations Toolkit: responding when the document request arrives.