Sequence,Action,Owner,Target Time,Evidence,Status
1,Record detection time and reporter,Incident lead,Immediate,Incident record,Open
2,Contain affected systems without destroying evidence,IT and security,Immediate,Action log,Open
3,Identify data principals data fields systems and processors,Incident team,Urgent,Scope assessment,Open
4,Assess confidentiality integrity and availability impact,Incident team,Urgent,Impact assessment,Open
5,Escalate to accountable management and advisers,Incident lead,Urgent,Decision log,Open
6,Prepare Board and affected-principal notifications as applicable,Compliance,Per applicable law,Draft and approval,Open
7,Preserve evidence and remediation records,Incident lead,Ongoing,Evidence register,Open
8,Complete root-cause and corrective-action review,Management,After containment,Closure report,Open