AI tool data leak or misuse: incident response playbook

First 15 minutes

1. Record what data, which tool, which account and when.
2. Delete the conversation or data in the tool if possible, and check the tool's retention and training settings.
3. Revoke the tool's or agent's access to company accounts, files and APIs.
4. Rotate any secrets or keys that were exposed.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (2 steps)
• Eradicate (1)
• Recover (1)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 8 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Phishing and business email compromise
• Ransomware
• Lost or stolen device
• Data sent to the wrong person or exposed
• Compromised account or cloud admin access
• Malware on a device
• Major outage or denial of service
• Supplier or third-party breach