Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates

Summary. This toolkit collects the working papers a company and its counsel need after a ransomware attack, each introduced by its purpose, owner, and timing and followed by drafting commentary tied to the governing authority. It begins with a deadline map and a negotiator instruction letter, then provides a payment decision memo, a sanctions screening record designed around OFAC's strict liability rule and its 2021 ransomware advisory, and a law enforcement contact log. Insurance and investigation templates include an insurer notice and consent request and a counsel-directed forensic engagement letter structured to protect the report. Regulator templates cover CIRCIA incident and payment reports, NYDFS 72-hour, 24-hour, and 30-day submissions, a HIPAA individual notice and HHS summary, and a state attorney general cover letter. The toolkit closes with a customer notice, an employee communications script, and a board briefing outline, all illustrated by a running example involving a public logistics company.

A ransomware response produces a predictable set of documents under unpredictable pressure. Most of them will be read later by someone hostile: a regulator asking why a deadline was missed, a plaintiff's lawyer asking what the company knew, an insurer asking whether consent was obtained, or OFAC asking who received the money. The templates below are written for that later reader. They are short where speed matters and detailed where the record matters.

The short answer

• Write the record as you go. The deadline map, the screening record, the law enforcement log, and the decision memo are the documents that prove the response was careful.
• Route investigation through counsel, on paper. The forensic engagement letter and the negotiator instructions establish privilege and control; courts look at the paper, not the intent.
• Report facts, not hopes. Every regulator template states what is known, says the investigation continues, and commits to update.
• Never let a payment template touch a notification template. Nothing in a payment decision changes who must be notified.

How to use this toolkit

Each template states its purpose, its owner, and when to use it, then gives the template and a short drafting commentary. Text in [BRACKETED CAPITALS] is to be filled in. Use one reference system across every document: INC- for the incident number, LE- for law enforcement contacts, SCR- for screening runs, REP- for regulator submissions, and BRD- for board materials, so that the decision memo can say "see SCR-3 and LE-2" and mean the same thing everywhere.

The sample entries follow the invented incident used in Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks. Corvane Logistics, Inc., a Nasdaq-listed freight and warehousing company in Columbus, Ohio, is hit on a Saturday by a group calling itself Nightjar, which encrypts routing and warehouse systems, copies 1.1 terabytes of data (drivers' files, a self-insured health plan's claims extract, and the client list of Corvane's New York-licensed insurance agency subsidiary), and demands $6.5 million. The legal analysis behind the templates is in Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers, and the tasks they support are listed in the Ransomware Readiness and Response Checklist: A Practical Checklist. General breach forms that are not ransomware-specific are in the Data Breach and Incident Response Toolkit: From Detection to Notification.

Template 1: Deadline map

Purpose: list every clock in one place, with an owner. Owner: breach counsel. When to use: on Day 0 or Day 1, updated as facts change.

Drafting commentary. Record the trigger time, not just the date, because some clocks run in hours. Use the trigger the rule actually uses: NYDFS runs from the determination that a reportable incident occurred; CIRCIA from reasonable belief that a covered cyber incident occurred, under the definitions in 6 U.S.C. § 681; the SEC from the materiality determination, which must itself be made without unreasonable delay; HIPAA and most state statutes from discovery. Add a row for each payment-triggered clock if a payment is made (NYDFS 24 hours and 30 days; CIRCIA 24 hours). Keep the map in the privileged file; it reflects counsel's analysis.

Template 2: Privileged forensic engagement letter

Purpose: retain the forensic firm through counsel, for counsel's legal advice, in a way that maximizes protection for its work. Owner: breach counsel, countersigned by the client. When to use: on Day 0, before the firm starts, and separately from any contract with the company's managed security provider.

[LAW FIRM LETTERHEAD]
[DATE]
PRIVILEGED AND CONFIDENTIAL
ATTORNEY WORK PRODUCT, PREPARED IN ANTICIPATION OF LITIGATION

[FORENSIC FIRM]
Re: Engagement to assist counsel, [CLIENT] incident INC-[NUMBER]

1. Engagement. [LAW FIRM] ("Counsel") represents [CLIENT] in connection with
   a cybersecurity incident first identified on [DATE] (the "Incident"), and
   anticipates litigation and regulatory proceedings arising from it. Counsel
   retains [FORENSIC FIRM] to assist Counsel in providing legal advice to
   [CLIENT] regarding the Incident.
2. Direction. [FORENSIC FIRM] will act at Counsel's direction, report to
   Counsel, and deliver all findings, drafts, and reports to Counsel only.
   Oral briefings are preferred until Counsel requests a written report.
3. Scope. Investigation of the means of intrusion, the scope of encryption,
   the scope and timing of data exfiltration, and related matters Counsel
   identifies. Containment and restoration are outside this engagement and
   are being performed by [REMEDIATION PROVIDER] under a separate agreement.
4. Confidentiality. [FORENSIC FIRM] will not disclose its work to anyone,
   including [CLIENT] personnel, insurers, or government agencies, except as
   Counsel directs in writing. Facts and indicators of compromise may be
   shared with law enforcement at Counsel's direction.
5. Fees. [RATES]. Invoices will be addressed to Counsel. [CLIENT] [or its
   insurer under policy NUMBER] will pay Counsel's invoices, which will
   include [FORENSIC FIRM]'s charges as a legal expense.
6. Records. [FORENSIC FIRM] will preserve all images, logs, and working
   files and will not destroy them without Counsel's written consent.
7. This letter is separate from, and does not incorporate, any prior
   agreement between [FORENSIC FIRM] and [CLIENT].

[SIGNATURES: COUNSEL, FORENSIC FIRM, CLIENT ACKNOWLEDGMENT]

Drafting commentary. Every clause answers a fact that cost a company its protection. In In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), the forensic firm worked under a pre-existing services agreement with similar scope, was initially paid from the cybersecurity budget, and its report went to dozens of employees, regulators, and an outside auditor; the court found the report would have been prepared in similar form without litigation. In Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021), there was no separate business-purpose investigation and the report was shared with IT staff and the FBI. Clauses 3, 4, 5, and 7 respond to those facts. Work product protection rests on Fed. R. Civ. P. 26(b)(3) and Hickman v. Taylor, 329 U.S. 495 (1947); privilege for a consultant who helps counsel advise rests on United States v. Kovel, 296 F.2d 918 (2d Cir. 1961) and the "one of the significant purposes" test of In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014). The letter does not protect underlying facts, and it cannot survive wide distribution of the report. For the doctrine, see Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest.

Template 3: Insurer notice and consent request

Purpose: give notice under the cyber policy, preserve coverage, and (later) request consent to any extortion payment. Owner: general counsel or the broker, reviewed by coverage counsel. When to use: Part A on Day 0; Part B before any payment.

PART A: NOTICE OF CIRCUMSTANCES AND CLAIM

To: [INSURER], claims department [ADDRESS / EMAIL / HOTLINE REFERENCE]
Policy: [NUMBER]; Named Insured: [CLIENT]; Policy period: [DATES]
Date of notice: [DATE]

[CLIENT] gives notice of a cybersecurity incident first discovered on
[DATE] at approximately [TIME]. An unauthorized party encrypted systems
and has demanded payment. [CLIENT] is investigating whether data was
taken. [CLIENT] requests coverage under all applicable insuring agreements,
including [CYBER EXTORTION, INCIDENT RESPONSE, DATA RESTORATION, BUSINESS
INTERRUPTION, PRIVACY LIABILITY, REGULATORY].

[CLIENT] requests confirmation of approved breach counsel, forensic,
negotiation, notification, and public relations vendors. [CLIENT] has
[not retained any vendor / retained the following on an emergency basis:
NAME, DATE, REASON].

[CLIENT] reserves all rights. This notice is not an admission of liability.

PART B: REQUEST FOR CONSENT TO EXTORTION PAYMENT

[CLIENT] requests the Insurer's written consent to a payment of up to
[AMOUNT AND CURRENCY] to resolve the extortion demand described in the
notice dated [DATE]. Enclosed are: the sanctions screening record
(SCR-[N]), the law enforcement contact log (LE-[N]), the restoration
analysis, and the proof-of-life results. [CLIENT] requests a response by
[DATE, TIME], given the attacker's stated deadline of [DATE, TIME].

Drafting commentary. Late notice and pre-consent payments are among the most common cyber coverage disputes, so Part A goes out before vendors are hired whenever possible, and the list of insuring agreements is deliberately broad. Part B attaches the screening record because the insurer is itself a potential facilitator under OFAC's 2021 advisory and will want to see the diligence before it consents. If the policy has a state-backed attack exclusion, ask coverage counsel whether to address attribution in the request; do not volunteer speculation about state sponsorship. The coverage background is in Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice, and model tender letters for other lines are in the Executive and Cyber Coverage Toolkit: Policy Comparisons, Notice Letters, and Allocation Analyses.

Template 4: Law enforcement contact log

Purpose: record every contact with law enforcement and CISA, to prove a timely, complete report and ongoing cooperation. Owner: breach counsel. When to use: from the first call.

Drafting commentary. OFAC's updated advisory treats a self-initiated, timely, and complete report to law enforcement or CISA, and full and ongoing cooperation, as significant mitigating factors in any enforcement response to a payment that later proves to have involved a sanctioned person; its Enforcement Guidelines appear in 31 C.F.R. Part 501. This log is the evidence of both. Record what was shared at the level of "indicators" and "summary," not "forensic report," because sharing the report itself was one of the facts in Wengui. The crime being reported is extortion under 18 U.S.C. § 1030(a)(7). If the company may later seek a national security or public safety delay of an SEC filing, the log also shows when the FBI was first engaged.

Template 5: Negotiator instruction letter

Purpose: put the negotiator under counsel's control, set its goals and limits, and fix its compensation. Owner: breach counsel. When to use: before the negotiator opens the attacker's channel.

PRIVILEGED AND CONFIDENTIAL; PREPARED AT THE DIRECTION OF COUNSEL

To: [NEGOTIATION FIRM]
Re: INC-[NUMBER]; instructions

1. You act at our direction and report to us daily, or immediately on any
   material development.
2. Goals, in order: (a) proof of life: decryption of [NUMBER] files we
   select; (b) a complete listing of data the attacker claims to hold;
   (c) time: extension of any deadline; (d) attribution data: wallet
   addresses, handles, tooling, language; (e) only if we authorize in
   writing, discussion of price.
3. Limits. You may not: commit [CLIENT] to pay; make statements about
   [CLIENT]'s insurance, regulators, law enforcement, or finances; threaten
   the attacker; agree to confidentiality from any government authority;
   or make any side arrangement.
4. Payment. No payment will be made without a written authorization from
   [DECISION MAKER] that recites the sanctions screening result and the
   insurer's written consent.
5. Records. Preserve complete transcripts with timestamps and deliver them
   to us.
6. Compensation. [FIXED FEE / HOURLY RATES]. No compensation is contingent
   on or measured by the amount of any payment.
7. Registration. Confirm that any entity that will receive or transmit
   funds is registered with FinCEN as a money services business where
   required and maintains an anti-money laundering program.

Drafting commentary. Clause 2 puts information ahead of price because the file listing feeds the notification analysis and the attribution data feeds the screen. Clause 3 prevents the most common self-inflicted wounds. Clause 6 removes the conflict created by percentage fees. Clause 7 tracks FinCEN's November 2021 advisory (FIN-2021-A004), which warned that firms that receive and transmit ransom funds may be money transmitters subject to registration under 31 C.F.R. Part 1022 and the definitions in 31 C.F.R. Part 1010. Public entities in North Carolina may not use this template at all; N.C. Gen. Stat. § 143-800 prohibits communicating with the attacker. Negotiation principles (anchoring, concessions, deadlines) are discussed in the Settlement Negotiation Toolkit: Case Valuation Worksheets, Concession Plans, and Offer Letters, with the caveat that this counterparty is a criminal and nothing it agrees to is enforceable.

Template 6: Sanctions screening record

Purpose: document attribution efforts and sanctions screening of every identifier before any price discussion and again before any payment. Owner: sanctions counsel, with the screening provider. When to use: SCR-1 before price; SCR-2 (and later runs) immediately before any payment.

Drafting commentary. OFAC may impose civil penalties for sanctions violations on a strict liability basis, and the statutory maximum under 50 U.S.C. § 1705 is the greater of an inflation-adjusted dollar amount or twice the transaction value. The prohibitions rest on 50 U.S.C. § 1702 and, for most ransomware designations, the Cyber-Related Sanctions Regulations, 31 C.F.R. Part 578; also check country programs such as 31 C.F.R. Part 510 and 31 C.F.R. Part 589. Because liability is strict, the record cannot make a sanctioned payment lawful. Its job is to show diligence and to stop a payment that should not be made. The "remaining uncertainty" row is the most important: OFAC, NYDFS, and the insurer will each want to know what the company did not know. Screening fundamentals, including the 50 percent rule, are in Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses.

Template 7: Payment decision memo

Purpose: present the facts, options, constraints, and recommendation for the payment decision in a form the board can act on and a regulator or court can later review. Owner: the general counsel, with the CISO and operations. When to use: before the board or its committee decides; update if facts change.

PRIVILEGED AND CONFIDENTIAL; ATTORNEY-CLIENT COMMUNICATION
To: Board of Directors [or COMMITTEE]   From: [GENERAL COUNSEL]
Date: [DATE]   Re: INC-[NUMBER]; whether to pay the extortion demand

1. Decision requested. Whether to authorize a payment of up to [AMOUNT],
   subject to the conditions in Part 9, or to decline.
2. Status. [Systems encrypted; systems restored; business impact to date.]
3. Restoration options.
   (a) Without a key: [SYSTEM]: [DAYS]; [SYSTEM]: [DAYS]. Backups: [AGE,
       CONDITION, TESTED Y/N].
   (b) With a working key: [SYSTEM]: [DAYS]. Decryptor tested: [Y/N,
       RESULT OF PROOF OF LIFE].
   (c) Operational, safety, customer, and covenant consequences of each.
4. Data taken. [CATEGORIES, VOLUME, POPULATIONS]. Notification obligations
   [LIST] apply whether or not a payment is made. The attacker's deletion
   promise cannot be verified and does not change them.
5. Sanctions. Screening results SCR-[N]: [SUMMARY]. Remaining uncertainty:
   [SUMMARY]. Civil liability is strict; OFAC presumes denial of licenses.
6. Insurance. Coverage position: [SUMMARY]. Consent: [REQUESTED / GRANTED
   / DECLINED], dated [DATE]. Exclusions in issue: [WAR / STATE-BACKED /
   OTHER].
7. Law enforcement. Reported LE-[N]. Input received: [SUMMARY].
8. Legal constraints and consequences. [STATE BAN? NYDFS 24-HOUR NOTICE AND
   30-DAY JUSTIFICATION; CIRCIA 24-HOUR REPORT IF IN EFFECT; SEC DISCLOSURE
   IF MATERIAL; LITIGATION EFFECTS.]
9. Conditions on any authorization. Written insurer consent; re-screen
   within [HOURS] of payment; payment through [INTERMEDIARY]; test
   decryption before full payment where possible; 24-hour reports filed.
10. Alternatives considered. [FREE DECRYPTORS, LAW ENFORCEMENT KEYS,
    REBUILD, PARTIAL RESTORATION, MANUAL OPERATIONS.]
11. Recommendation and reasons. [RECOMMENDATION.]

Drafting commentary. The memo is the company's answer, in advance, to the questions NYDFS requires a covered entity to answer within 30 days of any extortion payment under 23 N.Y.C.R.R. § 500.17(c): why the payment was necessary, what alternatives were considered, what diligence was done to find them, and what diligence was done to ensure compliance with OFAC and other rules. It is also the board's evidence of an informed, good-faith process under In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), Stone v. Ritter, 911 A.2d 362 (Del. 2006), and Marchand v. Barnhill, 212 A.3d 805 (Del. 2019). Part 4 exists to keep the payment decision from bleeding into the notification analysis, which HHS's ransomware guidance and the state statutes make independent of payment. In the Corvane example, Part 5 records the unresolved affiliate link, Part 6 records the insurer's refusal to consent while it remained unresolved, and Part 11 recommends declining. Note that Corvane's memo also recorded that a payment, had it been made, would trigger a 24-hour report to NYDFS and a 30-day written justification, and that the SEC disclosure would not mention negotiation unless it became material.

Template 8: Board briefing outline

Purpose: give directors the facts they need, and create the minutes that show they had them. Owner: general counsel and CISO. When to use: at the first board session (usually within 72 hours) and at each later session.

Drafting commentary. Minutes should record that the materials were circulated, who presented, the questions asked, and the decision, without transcribing privileged legal advice in detail. The dismissals of cyber oversight claims in Firemen's Retirement System of St. Louis v. Sorenson (Del. Ch. 2021) and Construction Industry Laborers Pension Fund v. Bingle (Del. 2023) relied on evidence that boards received regular cyber reporting. For public companies, the Item 106 annual disclosure under 17 C.F.R. § 229.106 will later describe the board's oversight process, so the briefing should match what that disclosure says. Minute-taking practice generally is covered in the Board Meeting and Minutes Checklist: A Practical Checklist.

Template 9: CIRCIA incident and ransom payment reports

Purpose: report a covered cyber incident within 72 hours and a ransom payment within 24 hours, once CISA's final rule is in effect. Owner: breach counsel, possibly through a third-party submitter. When to use: as triggered, once the final rule is in effect and the company falls within its covered-entity definition.

Drafting commentary. 6 U.S.C. § 681b requires both reports, allows a single combined report when an incident and a payment occur within the 72-hour window, permits a third party to submit on the entity's behalf, and requires supplemental reports when substantial new or different information becomes available. The ransom payment report is required even when the underlying attack is not a covered cyber incident. The definitions of "ransom payment" and "ransomware attack" are in 6 U.S.C. § 681. The statute provides that submissions do not waive privilege and limits their use in regulation and litigation, but write them as if they will be read by an adversary. CISA proposed its implementing rule in April 2024 and, as of October 2026, had not published a final rule; the reporting duties begin only on the effective date the final rule sets. Before filing, check whether it is in effect and use the form it prescribes.

Template 10: NYDFS submissions

Purpose: meet the three NYDFS clocks under 23 N.Y.C.R.R. § 500.17. Owner: the covered entity's compliance officer and counsel. When to use: 72 hours after determining a reportable incident; 24 hours after any extortion payment; 30 days after any extortion payment.

A. 72-HOUR NOTICE (500.17(a))
Covered entity: [NAME, LICENSE NUMBER]   Date of determination: [DATE]
Summary: On [DATE], [ENTITY] determined that a cybersecurity incident
affecting it occurred at [ENTITY / AFFILIATE / THIRD-PARTY SERVICE
PROVIDER]. [Brief factual description.] The investigation is continuing.
[ENTITY] will update this notice as material information becomes
available. Contact: [NAME, TITLE, PHONE, EMAIL].

B. 24-HOUR EXTORTION PAYMENT NOTICE (500.17(c)(1))
On [DATE, TIME], [ENTITY] made an extortion payment in connection with
the cybersecurity event reported on [DATE] (reference [DFS NUMBER]).

C. 30-DAY WRITTEN DESCRIPTION (500.17(c)(2))
1. Reasons the payment was necessary: [FROM DECISION MEMO PARTS 2-4].
2. Alternatives to payment considered: [FROM PART 10].
3. Diligence performed to find alternatives: [STEPS, DATES, VENDORS].
4. Diligence performed to ensure compliance with applicable rules and
   regulations, including those of OFAC: [SCR RECORDS; LE RECORDS;
   INTERMEDIARY COMPLIANCE].

Drafting commentary. The 72-hour clock runs from the determination that a reportable incident occurred, and it reaches incidents at affiliates and third-party service providers that affect the covered entity. The payment provisions took effect in December 2023. The 30-day description should be drawn directly from the decision memo and screening record, which is the main reason to write those documents carefully. Program requirements that NYDFS will examine after the incident are summarized in Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws.

Template 11: HIPAA individual notice and HHS summary

Purpose: notify affected individuals and HHS of a breach of unsecured protected health information. Owner: the covered entity (here, the health plan's administrator) with counsel. When to use: without unreasonable delay and within 60 calendar days after discovery.

[COVERED ENTITY LETTERHEAD]
[DATE]
[NAME, ADDRESS]

Notice of Data Breach

What happened. On [DATE], [PLAN NAME] discovered that an unauthorized
party had gained access to computer systems used to administer the plan,
encrypted them, and copied files. The copied files included information
about you.

What information was involved. [NAME, ADDRESS, DATE OF BIRTH, MEMBER ID,
CLAIMS INFORMATION INCLUDING DATES OF SERVICE AND PROVIDER NAMES, (IF
APPLICABLE) SOCIAL SECURITY NUMBER].

What we are doing. We contained the incident, engaged cybersecurity
experts, reported the incident to law enforcement, and [STEPS]. We are
offering [SERVICE] at no cost for [PERIOD].

What you can do. [STEPS: REVIEW EXPLANATIONS OF BENEFITS; ENROLL IN
SERVICE BY DATE; CREDIT FREEZE INFORMATION.]

For more information. Call [TOLL-FREE NUMBER], [HOURS], or write to
[ADDRESS].

Drafting commentary. The breach rule at 45 C.F.R. §§ 164.400 to 164.414, implementing 42 U.S.C. § 17932, requires the notice to describe what happened, including the dates of the breach and discovery, the types of information involved, steps individuals should take, what the entity is doing, and contact procedures including a toll-free number, in plain language. HHS's Ransomware and HIPAA fact sheet treats ransomware encryption of protected health information as a presumed breach unless a documented risk assessment shows a low probability of compromise; with exfiltration, that showing is unavailable. Breaches affecting 500 or more individuals must also be reported to HHS through its portal and, where more than 500 residents of a state are affected, to prominent media. Do not describe the attacker's deletion promise or the payment decision. The compliance background is in HIPAA Privacy and Security Compliance for Covered Entities and Business Associates.

Template 12: State attorney general cover letter

Purpose: transmit the required notice to a state attorney general or other regulator. Owner: breach counsel. When to use: with or before consumer notices, as each statute requires.

[DATE]
Office of the Attorney General, [STATE]
[ADDRESS / ONLINE PORTAL REFERENCE]

Re: Notice of security breach, [ENTITY]

We represent [ENTITY], [DESCRIPTION]. On [DATE], [ENTITY] discovered a
ransomware incident in which an unauthorized party encrypted systems and
copied files. [ENTITY]'s investigation determined that the files included
personal information of [NUMBER] [STATE] residents, consisting of [DATA
ELEMENTS]. [ENTITY] will mail notices to those residents on [DATE]; a
template is enclosed. [ENTITY] is offering [SERVICES]. [ENTITY] reported
the incident to federal law enforcement and has taken the following steps
to reduce the risk of recurrence: [STEPS]. [ENTITY] will also notify the
consumer reporting agencies [IF REQUIRED].

Contact: [NAME, PHONE, EMAIL].

Drafting commentary. Each statute sets its own thresholds, timing, content, and method (many states now require online portals). California, for example, requires notice to residents within 30 calendar days of discovery, and a sample copy of the notice to the Attorney General within 15 calendar days of notifying residents when more than 500 California residents are notified, under Cal. Civ. Code § 1798.82, and prescribes headings for the consumer notice. Keep the description of the attack consistent with every other filing. Statements to regulators and consumers are subject to the FTC Act's prohibition of deceptive practices, 15 U.S.C. § 45, and, for non-bank financial institutions, the FTC's own notice requirement under 16 C.F.R. § 314.4(j). See Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.

Template 13: Customer notice

Purpose: meet contractual notice obligations to business customers and preserve the relationship. Owner: commercial counsel, with account leaders. When to use: on the deadlines in each contract, often 24 to 72 hours, and updated as facts develop.

[DATE]
To: [CUSTOMER CONTACT NAMED IN NOTICE CLAUSE]
Re: Security incident notice under Section [X] of the [AGREEMENT]

On [DATE], Corvane identified a ransomware incident affecting its routing
and warehouse management systems. We isolated affected systems, engaged
outside cybersecurity experts through counsel, and notified law
enforcement. Our investigation is ongoing. At this time we [have / have
not] identified [CUSTOMER] data among the files the attacker accessed;
[IF IDENTIFIED: the affected data consists of (CATEGORIES)]. Shipments
are being handled by [CONTINGENCY]. We will provide updates by [DATE]
and as material information becomes available. Your contact for this
matter is [NAME, PHONE, EMAIL].

Drafting commentary. Read each contract's definition of "security incident" and its notice method; some require notice of suspected incidents, and some require specific content or cooperation. Do not concede breach of the security covenant, and do not speculate about scope. If the customer's own regulators depend on this notice (for example, a NYDFS-covered customer whose 72-hour clock may run from an incident at a third-party service provider), expect detailed follow-up questions and answer them consistently. Contract terms that should have been negotiated in advance are addressed in the Vendor Cybersecurity Diligence Checklist: A Practical Checklist.

Template 14: Employee communications script

Purpose: tell employees what happened, what to do, and what not to do, without creating admissions or rumors. Owner: HR and communications, reviewed by counsel. When to use: Day 1, with updates.

What happened: Corvane is responding to a cybersecurity incident that has
disrupted some of our systems. We have brought in outside experts and
notified law enforcement.

What to do:
- Use [OUT-OF-BAND CHANNEL / PHONE TREE] for updates. Do not use company
  email or chat to discuss the incident until told it is safe.
- Follow your manager's instructions for manual procedures.
- If anyone contacts you claiming to be the attacker, a reporter, or a
  government official, do not respond; forward the contact to [NAME].
- Report suspicious emails or calls to [SECURITY CONTACT].

What not to do:
- Do not speculate about the incident with customers, vendors, or on
  social media.
- Do not try to fix, restart, or wipe affected computers.
- Do not delete emails, files, or messages related to the incident.

If you are asked by a customer: "We are working through a systems issue
and taking it seriously. [ACCOUNT LEAD] will follow up with details."

Your information: [IF EMPLOYEE DATA IS INVOLVED: We are investigating
whether employee information was affected and will notify you directly
if it was, with information about protective services.]

Drafting commentary. Attackers increasingly contact employees directly, so the script tells them where to send those contacts. The "do not delete" line is part of the litigation hold under Fed. R. Civ. P. 37(e). The customer line is deliberately bland; inaccurate employee statements to customers can become evidence of what the company knew. If employee data was taken, employees are notification recipients in their own right, and their notices follow the same state and HIPAA rules as anyone else's.

Running example: how the templates fit together at Corvane

On Day 0, breach counsel opened the deadline map (Template 1), signed the forensic engagement letter (Template 2), and sent Part A of the insurer notice (Template 3). On Day 1, LE-1 and LE-2 went into the law enforcement log (Template 4). On Day 2, the negotiator received its instruction letter (Template 5) before opening the chat, and NYDFS received the 72-hour notice (Template 10A). On Day 3, SCR-1 (Template 6) recorded the unresolved affiliate link. On Day 4, the board received the decision memo (Template 7) through the BRD-1 agenda (Template 8) and declined to pay. Because Corvane did not pay, Templates 3B, 9 (payment column), 10B, and 10C were never used, although the decision memo cited them as consequences of the alternative. Templates 11 through 14 carried the notification and communications work from Day 1 through the end of the second week.

Two lessons stand out. First, the templates that mattered most were written before anyone knew whether Corvane would pay, which is why they read well afterward. Second, nothing in the payment track changed the notification track: the same drivers, plan participants, and agency clients were notified on the same schedule they would have been notified on if Corvane had paid.

This document is general information, not legal advice for any particular situation; regulators revise forms and rules frequently, so confirm current requirements before filing.

Related Documents

Related Articles

• Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers: the law each template implements.
• Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws: the regulatory programs behind Templates 9 and 10.
• Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses: sanctions screening behind Template 6.
• Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest: privilege doctrine behind Template 2.
• Paid Vulnerability Disclosure and the Line Between Research and Extortion: when a demand comes from a self-described researcher.
• Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges: collecting and authenticating text messages, chats, and social media evidence.

Related Guides

• Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks: the day-by-day sequence in which these templates are used.
• Responding to a Data Breach: The First Seventy-Two Hours: the general breach playbook.
• Placing and Tendering a D&O or Cyber Claim: A Practical Guide: the tender process behind Template 3.
• Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide: collecting and authenticating text messages, chats, and social media evidence.

Related Checklists

• Ransomware Readiness and Response Checklist: A Practical Checklist: the tasks these templates document.
• Board Meeting and Minutes Checklist: A Practical Checklist: minute-taking for Template 8.
• Vendor Cybersecurity Diligence Checklist: A Practical Checklist: the contract terms behind Template 13.
• Messaging and Social Media Evidence Checklist: A Practical Checklist: collecting and authenticating text messages, chats, and social media evidence.

Related Toolkits

• Data Breach and Incident Response Toolkit: From Detection to Notification: general incident and notification forms.
• Executive and Cyber Coverage Toolkit: Policy Comparisons, Notice Letters, and Allocation Analyses: coverage notice letters and policy comparisons.
• Settlement Negotiation Toolkit: Case Valuation Worksheets, Concession Plans, and Offer Letters: negotiation planning tools adaptable to Template 5.
• Vulnerability Disclosure Toolkit: VDP Policies, Safe Harbor Terms, Researcher Agreements, and Response Letters: response letters for researcher demands that are not ransomware.
• Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications: collecting and authenticating text messages, chats, and social media evidence.