# Out-of-Band Readiness: customize my results

You are an experienced incident response and crisis communications advisor. Below are the results of an
Out-of-Band (OOB) Communications Readiness assessment, scored against the BreachRx OOB Maturity Model
(Level 1 Improvised, Level 2 Standby, Level 3 Integrated, Level 4 Assured), plus a generic 90-day plan.

Your task:
1. Ask me any clarifying questions you need about the company context below before giving advice.
2. Tailor the findings and 90-day plan to my specific situation: size, industry, regulators, existing tools,
   team structure and budget. Remove actions that do not apply and add any that are missing.
3. Assign realistic owners and dates, and flag dependencies between actions.
4. Draft a short executive summary (under 200 words) I can share with leadership.
5. Keep recommendations vendor-neutral unless I ask otherwise. Do not present this as legal advice.

## My company context (edit before sending)

- Organization: [fill in]
- Industry: Financial Services
- Employees / regions: [fill in]
- Key regulators and notification obligations: [fill in]
- Primary collaboration tools (e.g. M365, Google Workspace, Slack): [fill in]
- Incident response team structure and outside counsel/IR retainer: [fill in]
- Known constraints (budget, headcount, recent incidents, audits): [fill in]

## Assessment results

- Assessed: January 15, 2026
- Overall maturity: Level 2 (Standby), average 1.83 of 4
- Dimensions on target: 0 of 6

| Dimension | Current | Target |
| --- | --- | --- |
| Independence from Affected Systems | L2 Standby | L3 |
| Activation & Access | L1 Improvised | L2 |
| Privileged Collaboration | L2 Standby | L3 |
| Executive Command | L3 Integrated | L4 |
| Record Continuity | L1 Improvised | L2 |
| Rehearsal & Readiness | L2 Standby | L3 |

## Findings (weakest first)

### Activation & Access (Level 1 Improvised, target Level 2)
- Selected statement: "We’d track people down and invite them as we go."
- Risk: Delays in reaching legal, communications, executives, and partners slow every downstream decision.
- Next step: Create and maintain a role-owned contact roster and a documented fallback activation procedure.

### Record Continuity (Level 1 Improvised, target Level 2)
- Selected statement: "We rebuild the timeline from inboxes and text threads afterward."
- Risk: Reconstructing the timeline from inboxes and texts after the fact risks gaps when decisions must be explained later.
- Next step: Agree an authoritative incident record and a decision capture process for out-of-band work.

### Independence from Affected Systems (Level 2 Standby, target Level 3)
- Selected statement: "We have a backup tool, but it relies on our corporate identity."
- Risk: If email, chat, or corporate identity are compromised, the response team may lose its primary means of coordinating.
- Next step: Separate response mail, chat, and meetings from corporate systems and validate that access does not depend on corporate identity.

### Privileged Collaboration (Level 2 Standby, target Level 3)
- Selected statement: "Legal has its own channel, separate from the wider response."
- Risk: Counsel working in personal or consumer channels can expose sensitive findings and complicate privilege handling.
- Next step: Define protected, role-based legal workstreams connected to the broader response, with documented boundaries.

### Rehearsal & Readiness (Level 2 Standby, target Level 3)
- Selected statement: "Security tests the backup channel occasionally, on its own."
- Risk: An untested fallback plan may fail in ways that only surface during a real incident.
- Next step: Make the exercise cross-functional and validate external access, executive updates, and response handoffs in the out-of-band environment.

### Executive Command (Level 3 Integrated, target Level 4)
- Selected statement: "Leaders see live status and decisions on protected mobile access."
- Risk: Leaders relying on personal texts or ad hoc calls may decide without current, trusted information.
- Next step: Deliver decision-ready context to executives as material facts change, without requiring them to follow every thread.

## Current 90-day plan

### Days 1–30: Remediate independence and activation foundations; set owners and measures.
- [Activation & Access] Create and maintain a role-owned contact roster and a documented fallback activation procedure. (High, owner: Incident Response Lead, due: 2026-02-14)
  - Deliverable: Role-based contact roster and activation runbook.
- [Record Continuity] Agree an authoritative incident record and a decision capture process for out-of-band work. (High, owner: Incident Response Lead with Legal, due: 2026-02-14)
  - Deliverable: Incident record standard and decision capture template.
- [Independence from Affected Systems] Separate response mail, chat, and meetings from corporate systems and validate that access does not depend on corporate identity. (High, owner: CISO / Head of Security Operations, due: 2026-02-14)
  - Deliverable: Independent response environment covering mail, chat, meetings, and files.

### Days 31–60: Configure privilege-aware collaboration, executive continuity and record workflows.
- [Privileged Collaboration] Define protected, role-based legal workstreams connected to the broader response, with documented boundaries. (High, owner: General Counsel / Privacy Counsel, due: 2026-03-16)
  - Deliverable: Workstream design with documented privilege boundaries and membership rules.
- [Executive Command] Deliver decision-ready context to executives as material facts change, without requiring them to follow every thread. (Medium, owner: CISO with Chief of Staff, due: 2026-03-16)
  - Deliverable: Material-change summary template and trigger criteria.

### Days 61–90: Run a cross-functional communications-down exercise, measure outcomes, update plans.
- [Rehearsal & Readiness] Make the exercise cross-functional and validate external access, executive updates, and response handoffs in the out-of-band environment. (High, owner: Incident Response Lead / Exercise Coordinator, due: 2026-04-15)
  - Deliverable: Cross-functional tabletop with measured activation time.

## Executive asks

- Require each function to name primary and backup responders.
- Designate the authoritative incident record.
- Fund and approve an identity-independent response environment.
- Approve the legal workstream model and outside counsel participation.
- Require participation from each function and at least one executive.

---
Results are self-reported planning guidance, not legal advice. Review any output before sharing it.