Data Breach Plan Gap Checker
Many organisations publish a short data breach response plan: identify, document evidence, stop the loss, evaluate, notify customers, prevent. It reads well, and it usually misses things a regulator, insurer or court will ask about. Paste your plan, or load a fictional sample, and see what is found, partly covered or missing, which common traps it falls into, and the five fixes to make first.
Your text stays in your browser. Nothing is uploaded, stored or logged.
Checked in your browser. The text is never uploaded, stored or logged.
What this checker does
- Paste your data breach response plan, or load a fictional sample, and get an instant gap report against 31 elements a complete plan usually covers.
- Elements are grouped into governance, detection and scoping, evidence, containment, notification, communications, and recovery. Each one is marked found, partly or missing, with one sentence on why it matters and a link to a PlayCISO page that helps fix it.
- A traps detector flags common mistakes in short published plans: password resets without revoking sessions, customer notice with no regulator clock, one shared mailbox as the only contact, evidence that is just "copy the logs", and agency names that have changed.
- You get a 0 to 100 score, the five fixes that matter most, and a plain-text gap report to copy into a ticket or email.
- It runs entirely in your browser. The plan text is never uploaded, stored or logged.
Why short breach plans miss things
A one-page plan is written to show customers that a process exists. The steps are right in outline, but the details that decide the outcome are left out: who has authority at 2am, what must be captured before anyone changes a system, which regulator clock started and when, and what the company is obliged to tell its own business customers.
Service providers have an extra gap. If you host or process data for other organisations, they are usually the controllers and you are the processor. Their notification clock can start when you tell them, so “we will call affected customers” is a legal duty with a time limit, not a courtesy.
Fix the gaps with the Data Breach Response Checklist, work out your deadlines with the Breach Notification Clock Calculator, and then rehearse the plan in the Customer Database Breach Lab.
Frequently asked questions
What should a data breach response plan include?
At minimum: a named incident lead with authority to act, deputies and out-of-hours contacts, severity levels, one clear way to report a suspected breach, a rule to preserve evidence before making changes, containment that covers sessions, tokens, MFA and keys (not just passwords), a scoping step for data types, numbers of people and where they live, a harm assessment, each notification duty with its deadline and trigger, when to involve legal counsel and your cyber insurer, holding statements and a single spokesperson, and a post-incident review with tracked actions. It also needs an owner, a review date and a yearly tabletop exercise, because an untested plan is a guess.
What is the difference between a controller's and a processor's breach duties?
Under the GDPR, the controller decides why and how personal data is used. It must notify the supervisory authority within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to people, and must tell the people affected when the risk to them is high. A processor handles data on the controller's behalf, such as a hosting, SaaS or payroll provider. It must tell the controller without undue delay after becoming aware, and contracts often set a fixed number of hours. The processor usually does not notify the regulator or individuals itself unless the contract or a local law says so. Other laws use different terms; in Australia's Notifiable Data Breaches scheme, for example, when more than one organisation holds the data, one of them can assess and notify for all. Check with counsel for your situation.
How does the checker decide whether something is in my plan?
It looks for the words and phrases a plan normally uses for each element, such as "chain of custody", "revoke sessions" or "72 hours". A full match counts as found, a weaker match as partly, and no match as missing. Material elements, such as legal counsel, regulator deadlines and evidence preservation, carry more weight in the score. Finding the words does not prove the process works, and a good plan can use other words, so treat the report as a reviewer's first pass and test the plan with a tabletop exercise.
Why is changing passwords not enough to contain a breach?
A password reset does not end sessions an attacker already has. Session cookies and refresh tokens can stay valid, and an attacker who registered their own MFA device or created an API key keeps that access too. Containment should revoke active sessions and tokens, review MFA methods, rotate keys and secrets, and hunt for new accounts, mail rules or scheduled tasks before you declare the incident contained.
Our plan lists CERT Australia and US-CERT. Are those still the right contacts?
Those names are out of date. CERT Australia's functions moved into the Australian Cyber Security Centre, now part of the Australian Signals Directorate, and incidents are reported through cyber.gov.au. US-CERT's functions are now part of CISA, the Cybersecurity and Infrastructure Security Agency. Agencies change, so check the current reporting route on each agency's own website at every plan review.
Is my plan text sent anywhere?
No. The checks run in your browser with JavaScript. The text is not uploaded, stored or logged, and it is gone when you close the page. The sample plan is for a fictional company, Northwind Hosting.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.