AI and Cyber Incident Response One-Pager (template)

Lean AI Gov template by Fresco Consulting. Fill in every bracket, print it, and keep a copy offline. Not legal advice.

Company: [name] Last updated: [date]

Who to call

• Incident lead: [name, mobile]
• Backup: [name, mobile]
• IT provider or MSP: [company, 24/7 number, ticket email]
• Cyber insurance carrier and claim line: [carrier, policy number, phone]. Many policies require prompt notice and use of approved vendors; check yours before paying anyone.
• Attorney: [name, phone]
• Bank fraud line (for payment fraud): [phone]
• Local police non-emergency: [phone]. FBI Internet Crime Complaint Center: ic3.gov

What counts as an incident

• Confidential or regulated data put into an AI tool that is not approved for it.
• A lost or stolen device, or a password or AI account used by someone else.
• A wrong or harmful AI output that reached a client.
• A payment, gift card, or password request that may be a scam, including a cloned voice or video of someone you know.
• Ransomware, unusual pop-ups, or files you cannot open.

The first hour

1. Stop and contain. Do not keep using the affected account or device. Disconnect a suspected infected computer from the network, but do not turn it off or wipe it.
2. Call the incident lead, then the IT provider.
3. Preserve evidence. Take screenshots, save emails and chat logs, write down times. Do not delete anything.
4. Lock accounts. Change passwords and revoke sessions for affected accounts from a clean device. Confirm MFA is on.
5. For payment scams: call the bank's fraud line immediately to try to stop or recall the payment.
6. For data put into an AI tool: delete the conversation if the tool allows, note exactly what was shared, and check the vendor's data retention terms.

Within 24 hours

• Notify the cyber insurance carrier if your policy requires it.
• Decide with the attorney whether personal information was involved and what notices may be required.
• Write a short timeline: what happened, when it was found, what was done.

Notification reminders (confirm with your attorney)

• Florida's Information Protection Act (s. 501.171, Florida Statutes) generally requires notice to affected Florida residents no later than 30 days after a breach of personal information is determined or reasonably believed, notice to the Florida Department of Legal Affairs if 500 or more Florida residents are affected, and notice to consumer reporting agencies if more than 1,000 are affected at one time. Other states and client contracts may have their own rules.
• Client contracts may require notice within a set number of hours or days. List the strictest here: [client, deadline].

After it is over

• 30-minute review meeting: what happened, what worked, what to change.
• Update the AI use policy, tool list, and this page.
• Retrain anyone involved, without blame.

Do not

• Pay a ransom or a suspicious invoice without talking to the incident lead, insurer, and attorney.
• Post about the incident publicly or tell clients before the plan is agreed.
• Wipe devices before the IT provider says it is safe.