After a breach, a regulator may come asking questions. The company has to answer one thing well, under pressure: how do you tell the truth without conceding “unreasonable security”, handle the document request without destroying records, protect privilege, and avoid the admissions that create liability? This prep sheet gives you the structure — the protocol, the defensible framing, the preservation log, the dos & don’ts, who speaks, and the follow-up.
Educational template — not legal advice. The regulatory concepts are summarised for orientation and can change; adapt this with qualified counsel.
Free · no signup · adapt it in your own doc
Post-Breach Regulator Response Prep Sheet
Privileged & confidential — prepared at the direction of counsel. This sheet readies the team for a post-breach interview with a regulator (FTC, SEC, a state Attorney General or a data-protection authority): the protocol for the room, how to frame the program defensibly, the document-request and preservation log, the dos & don’ts, who speaks, and the follow-up.
01Pre-interview protocol
Before anyone speaks to the regulator, counsel scopes the request and decides who attends. Pin down the legal nature of the inquiry first — it changes your obligations and your options.
Regulator / inquiry
FTC / SEC / state AG / DPA — matter reference
Lead counsel (present for all contact)
Internal + outside counsel names
Voluntary or compelled?
Voluntary interview / subpoena / civil investigative demand — and what each requires
Scope as understood
Topics, time period, systems/data in scope
Date / format / attendees agreed with counsel
When, where, who attends
All regulator contact routed through counsel first — no one responds to the regulator directly
Voluntary vs compelled nature confirmed (a voluntary interview can be scoped, timed or deferred; compelled process carries obligations)
Scope, timing and attendees negotiated/agreed through counsel before committing
Interviewees briefed and prepared with counsel; no unprepared executives in the room
Facts current as of the session assembled and verified — not from memory
There is no "off the record" with a regulator. Hallway, break and casual remarks are still statements to the government. Keep all substantive communication structured, truthful and with counsel present.
02Anticipated questions & defensible framing
The standard regulators apply is REASONABLE, risk-appropriate security — not perfect security, and not a specific product. Frame the program against a recognized framework; answer with facts and point to evidence. Do not claim perfection, and do not concede the program was "inadequate" or "unreasonable" — that is the contested legal conclusion counsel manages.
Likely question
Defensible framing
Evidence to cite
Was your security program adequate?
A reasonable, risk-based program mapped to a recognized framework (NIST CSF / ISO 27001), with controls appropriate to the risk — not a claim of perfection
The factual timeline as verified; "we are confirming the exact time and will follow up" where not certain
Incident timeline, detection logs, IR records
What did you do in response?
The containment, investigation and notification steps actually taken, in order
IR runbook executed, forensic engagement, notifications sent
Did you know about this weakness beforehand?
Answer truthfully and factually; let counsel handle characterization — avoid volunteering known-risk-plus-inaction admissions
Risk register, remediation tickets and their status — as facts, via counsel
Why did the controls fail?
The factual root cause; frame remediation as continuous improvement, not an admission the program was unreasonable
Root-cause analysis, remediation plan
Stick to facts you have verified. If you are not certain, say so and offer to confirm and follow up through counsel — never speculate or guess on the record.
03Document-request & preservation log
Once an investigation is reasonably anticipated you must preserve. A litigation hold stops routine deletion. Altering or destroying responsive records is spoliation and can be criminal obstruction. Production is scoped and reviewed by counsel — never raw-dumped, and never scrubbed.
Possibly privileged / work product — do not produce without counsel
Internal-investigation interview memos
Counsel-led
Withheld
Privileged — selective disclosure can waive
Do not delete, alter or back-date any record, and do not selectively hand over privileged material to appear cooperative — waiver decisions are counsel’s, made deliberately. Concealing a breach or disguising a payment to buy silence (cf. the Uber case) can turn a security failure into a criminal obstruction case.
04Dos & don’ts in the room
DO route every question and response through counsel
DO frame the program as reasonable and risk-based, mapped to a recognized framework
DO stick to verified facts; if unsure, say so and offer to confirm and follow up
DO maintain a cooperative, organized, responsive posture
DON’T speculate, guess or estimate on the record
DON’T concede "unreasonable" or "inadequate" security — that is the legal conclusion at issue
DON’T volunteer admissions of knowing neglect ("we knew and never fixed it")
DON’T make a legal admission of liability, even to speed a settlement
DON’T destroy, alter or scrub records, or waive privilege to look open
DON’T let unprepared executives freelance answers outside their area
05Spokesperson & escalation matrix
A single, prepared, counsel-supported spokesperson keeps the company’s account consistent and accurate. Others speak only to their prepared areas. Hold one factual, counsel-approved account across every audience — regulators, litigants and press comparing notes will seize on any inconsistency.
Designated spokesperson (with counsel)
Name / role
Subject-matter backups (prepared areas only)
Name — area; Name — area
Who may NOT speak unprepared
e.g. engineers, line managers — refer to spokesperson/counsel
Escalation path for a new/unexpected demand
Who is notified, who decides
Single approved account of the facts
The one counsel-approved narrative used with every audience
Everything said in one forum can surface in another. Route regulators, plaintiffs’ counsel and press through the single spokesperson/counsel so the account never drifts.
06Post-interview follow-up
Debrief with counsel immediately — capture every question asked and answer given
Identify any statement that was inaccurate or incomplete
Correct any misstatement promptly, in writing, through counsel — before the regulator relies on it
Deliver promised follow-ups and confirmations through counsel, on the agreed timeline
Log all commitments made to the regulator and track them to completion
Preserve the record of the interview and the decision trail; maintain privilege
Follow-ups / confirmations owed
Item — owner — due date — via counsel
Corrections to issue
What was inaccurate — corrected statement — date sent
Commitments made to the regulator
Commitment — owner — status
Practice the decision
This sheet readies you for a call you can rehearse. The free Regulator Interview Lab sits you across the table from an FTC, SEC, state-AG or data-protection inquiry and grades you on ~14 of the exact decisions this sheet prepares — route it through counsel, frame reasonable security, preserve records, guard privilege, and avoid the admission that sinks you.
TL;DR
What this template is
A board-ready prep sheet that readies the team for a post-breach regulator or enforcement interview (FTC, SEC, a state Attorney General or a data-protection authority): the protocol, the defensible framing, the document log, the dos & don’ts, who speaks, and the follow-up.
The core discipline: route everything through counsel, answer truthfully without conceding "unreasonable security", frame the program against a recognized framework (NIST CSF / ISO 27001), preserve every record and destroy none, guard privilege, and keep one prepared spokesperson.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Regulator Interview Lab.
Educational template — not legal advice. Use it with qualified counsel.
Frequently asked questions
What is this template for?+
It is a prep sheet a company can use to ready its team for a post-breach interview with a regulator — the FTC, SEC, a state Attorney General or a data-protection authority. It captures the pre-interview protocol, anticipated questions and defensible framing, the document-request and preservation log, the dos & don’ts in the room, the spokesperson matrix, and the post-interview follow-up.
How do you answer without conceding "unreasonable security"?+
Regulators apply a standard of reasonable, risk-appropriate security — not perfect security. You describe a risk-based program mapped to a recognized framework such as NIST CSF or ISO 27001, answer with verified facts, and point to evidence. You do not claim the program was perfect, and you do not concede it was "inadequate" or "unreasonable" — that is the contested legal conclusion your counsel manages. You cooperate with facts; you do not volunteer the admission of liability.
What about document requests and privilege?+
Once an investigation is reasonably anticipated you must preserve: issue or confirm a litigation hold, stop routine deletion, and never alter or destroy responsive records — spoliation can be criminal obstruction. Production is scoped and reviewed by counsel. Material prepared at counsel’s direction for legal advice (for example a forensic report or internal-investigation memos) may be privileged or work product; counsel decides what is produced, because selectively handing it over to look cooperative can waive privilege over the whole subject matter.
Is this legal advice?+
No. It is an educational template. The regulatory concepts (reasonable security, the FTC Act, the Safeguards Rule, state data-security laws, litigation hold, spoliation, privilege) are summarised for orientation and can change; confirm current requirements and apply them to your specific facts with qualified counsel.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout