Data Incident / Breach Response Readiness

The first 10 questions

This is where the conversation starts. Each answer shapes what gets asked next.

1. 01What's prompting this — a specific scare, an enterprise customer's security questionnaire, or just wanting to be prepared?
2. 02What sensitive data does your product actually hold today — credentials, payment info, PII, health/financial data?
3. 03Do you have any incident response process today, even informal, or is this the first pass?
4. 04What's your actual capability to detect an incident today — logging, alerting, a security tool — versus what you'd need to add?
5. 05Who is realistically available to respond at any hour, given you're a small team — is this genuinely a one-person job right now?
6. 06What legal obligations apply to you specifically — GDPR's 72-hour rule, state breach notification laws, contractual DPA commitments?
7. 07What's the scenario that worries you most — a credential leak, a misconfigured database, a compromised vendor?
8. 08Severity classification: what makes an incident low/medium/high/critical, in terms specific to your product and data.
9. 09Response roles: who does what the moment an incident is suspected — even if that's just you and one other person today.
10. 10Containment steps: the first actions to take to stop the incident from getting worse, for your most likely scenarios.

+ 6 more questions across discovery, validation, and the creative brief — each one adapting to what you've already said.

Related legal project types

• Incorporate Now — and As What?Decide whether it's time to incorporate, and what to form — LLC, C-corp, or your home-country equivalent — based on what you're actually doing, not startup folklore.
• Founder AgreementWork through equity, vesting, IP ownership, roles, and what happens if someone leaves — before those conversations become awkward or costly.
• Privacy PolicyThink through what data you collect, how you use it, and who you share it with — and produce a privacy policy tailored to your product, not a generic paste job.