If a customer reports a strange invoice or your email account shows an unfamiliar sign-in, your first job is to stop further exposure without erasing the evidence. A small office needs a named decision-maker, a safe way to communicate, and a record of what happened—not a rush to reinstall every computer.
This is operational guidance, not legal advice. The 72-hour checklist below is a planning framework, not a Florida reporting deadline or permission to wait. Start immediately. Counsel should determine which laws, contracts, insurance terms, and notification deadlines apply to your incident and confirm the law in force when it happens.
First Hour: Assign an Owner and Contain the Problem
For a Sarasota consultant working from home or a Bradenton office with three employees, the owner may also be the response coordinator. Name a backup person who can act if that owner is unavailable. Our SOHO managed IT services focus on documenting these responsibilities before an interruption.
- Start an incident log. Record when the issue was discovered, who reported it, affected devices or accounts, and each action with its time and time zone. Keep facts separate from suspicions. Store the log somewhere the suspected attacker cannot access.
- Use a clean communications channel. Call your IT contact and owner from a known-good phone. Don't coordinate recovery inside a mailbox you suspect is compromised. Retrieve your insurer's incident number and counsel's contact details from a saved offline list.
- Disconnect affected equipment from the network. Unplug its network cable and disconnect Wi-Fi; don't reconnect it to check whether it works. The FTC advises taking affected equipment offline without turning machines off until forensic experts arrive. Ask responders for incident-specific instructions rather than wiping, rebooting, or running cleanup tools yourself.
- Contain account access with your IT responder. From a clean device, have the authorized administrator block suspicious access, revoke active sessions, and reset affected credentials. Preserve relevant logs and document changes. A password change alone is not proof that an attacker has lost access.
The FTC's Data Breach Response: A Guide for Business recommends mobilizing a response team, consulting counsel, stopping additional data loss, and preserving forensic evidence. Those priorities are useful even when you have not yet established that a legally defined breach occurred.
Hours 1–24: Establish Scope and Protect Daily Work
Ask your technical responder to preserve available email sign-in and audit logs, suspicious messages with headers, forwarding rules, device alerts, and cloud-sharing records. Access should be limited to the response team. Do not paste client records into this website's contact form or an unapproved AI tool to ask what they mean.
- Map the information, not just the broken computer. Identify which customer files, payroll records, account credentials, and shared folders may have been accessed. Record known affected people separately from people still under investigation.
- Contact the insurer promptly. Check the policy's notice process and whether outside responders require approval. Don't assume an ordinary IT agreement includes independent forensics, legal representation, or every recovery expense.
- Address money movement separately. If invoice details or payments may have been altered, contact the bank using a known number immediately. Don't wait for the rest of the investigation. The FTC also recommends notifying law enforcement and affected businesses as appropriate.
- Choose a temporary operating plan. Use approved clean devices and minimal necessary data. Don't forward customer files to personal email to keep work moving. Write down which tasks must pause and who will tell customers about scheduling changes.
Make the plan fit your geography. A Lakewood Ranch business with staff working from homes in both Sarasota and Manatee counties should list each remote laptop and who can physically disconnect it. Keep the contact sheet available if office internet or power is down. If you serve seasonal customers who live outside Florida, tell counsel their states of residence; your office address does not settle every notice obligation.
This is where managed IT versus break-fix scope matters: know who preserves logs, who can disable accounts, and who authorizes recovery before you need those decisions.
Hours 24–48: Build the Florida Notification Decision File
Use Florida Statutes (2025), §501.171 as a specific reference for your discussion with counsel, not as a do-it-yourself legal determination. The cited edition defines a breach as unauthorized access to electronic data containing personal information, subject to its definitions and exceptions. It covers commercial entities including sole proprietorships; a small headcount is not a blanket exemption.
The definition of personal information includes specified name-and-data combinations, such as a name with a Social Security number, and also a username or email address combined with a password or security answer that permits online-account access. The statute excludes certain publicly available or unusable protected information. Have responders establish the actual data and protection involved; don't assume a product's encryption checkbox resolves the legal question.
- Individual notice: Under subsection (4), a covered entity generally must notify each affected Florida individual whose personal information was, or is reasonably believed to have been, accessed. Notice must be as expeditious as practicable and without unreasonable delay, and generally no later than 30 days after determining a breach or having reason to believe one occurred, subject to statutory exceptions.
- State notice: Under subsection (3), a breach affecting 500 or more individuals in Florida requires notice to the Department of Legal Affairs as expeditiously as practicable, no later than 30 days after determination or reason to believe. Fewer than 500 affected people does not eliminate the separate individual-notice requirement.
- Third-party systems: Subsection (6) requires a third-party agent to notify the covered entity as expeditiously as practicable, no later than 10 days after determination or reason to believe a breach occurred. Outsourcing storage does not automatically transfer your business's notification responsibility.
- Additional recipients: Subsection (5) requires notice, without unreasonable delay, to nationwide consumer reporting agencies when circumstances require notice to more than 1,000 individuals at a single time.
These are not instructions to wait until day 10 or day 30. Have counsel assess any permitted extension, law-enforcement delay, or exception. In particular, the no-identity-theft-or-financial-harm determination in subsection (4)(c) requires an appropriate investigation and law-enforcement consultation, written documentation retained for at least five years, and delivery of that determination to the department within 30 days after the determination. An owner's belief that “nothing was stolen” is not that process.
Prepare a restricted-access decision file: discovery timeline, data categories, affected-person counts and residence information, technical findings, notice owners, and counsel's deadline analysis. Ask counsel to check applicable federal or sector-specific requirements and contractual notice terms as well. This checklist does not replace those obligations.
Hours 48–72: Verify Recovery and Communicate What You Know
Recovery should follow evidence and containment, not the clock. Your responder should assess the entry point, remove unauthorized access, and validate clean recovery copies before restoring essential work. Our backup and disaster recovery services address recovery planning and testing; successful file restoration alone does not answer whether someone accessed personal information.
- Test one essential workflow. Verify that a clean account can open the correct customer records, send legitimate mail, and complete the next business-critical task. Record missing data and remaining restrictions before expanding access.
- Assign one communications owner. Use counsel-reviewed notices when required. Explain confirmed facts, what remains under investigation, protective steps, and a reliable contact method. Don't promise “no data was accessed” merely because files are available again.
- Keep monitoring and follow-up work open. Track unresolved accounts, vendor findings, notification decisions, and remediation owners beyond hour 72. The checklist is the beginning of a response, not a guarantee of recovery within three days.
For preparation that reduces the chance of another interruption, our ransomware protection guide for Florida firms explains layered defenses and protected backups. Not every breach involves ransomware, and restoring encrypted files does not undo a disclosure.
Three Things You Can Do This Week
- Write and rehearse a one-page call tree. Include the owner, backup decision-maker, IT responder, insurer, counsel, and bank. Run a short scenario: your business email is unavailable and a customer reports a changed invoice. Keep an offline copy without passwords.
- Verify account protection. Have your administrator check MFA enrollment for staff and administrator accounts, using phishing-resistant methods where available. Review who can access payroll, customer files, and backups.
- Prove a restore works. Test a representative file or workflow in an isolated location, record the time and result, and fix missing coverage. A green backup status is not a completed restore test.
CISA's Small Business Cyber Guidance supports these preparation steps: leadership-approved incident response plans, offline contact information, tabletop exercises, verified MFA coverage, and tested restores. It recommends reviewing the plan quarterly and after incidents or near misses. These controls reduce risk; they do not guarantee that an incident cannot happen.
Turn the Checklist Into Your Office's Plan
We help Sarasota and Manatee businesses document their systems, review access, and identify practical recovery gaps. Our Free Systems Audit is on-site at your business, usually takes 45–60 minutes within a 60-minute booking slot, and includes a full, customized Client Threat & Architecture Report after the completed audit. Use the request form for preparation and general priorities, not sensitive incident evidence. An audit request is not an emergency incident-response dispatch.
Gregory Mathews, Systems Architect, Suncoast MIS LLC
Source Notes and Scope
This article uses the FTC's August 2023 business breach-response guide for containment, evidence preservation, and communications; CISA's small-business guidance (page updated April 2024) for preparation; and the expressly cited 2025 edition of Florida §501.171 for the legal reference points above. These primary sources were reviewed for this article. The hour-by-hour sequence is our operational organization of those priorities, not a timetable prescribed by any of the three sources. Confirm subsequent legal changes and incident-specific duties with qualified counsel.
Author & technical scope review
Gregory Mathews
Gregory is the Systems Architect and founder of Suncoast MIS, with 15+ years of practical IT and systems architecture experience. He authored this article and reviewed its technical scope. Compliance and legal conclusions remain with each organization and its qualified advisors.