Cannabis Incident Response Template

The Complete Playbook for Handling Cybersecurity Incidents, Data Breaches & Compliance Emergencies

When the breach happens, you won't have time to figure out what to do. This template tells you exactly how to respond—minute by minute, hour by hour.

HOW TO USE THIS TEMPLATE

Before an incident:

1. Customize all sections with your business information
2. Fill in contact information for your team
3. Print physical copies (digital may be inaccessible during incident)
4. Store copies in multiple locations (office, home, cloud)
5. Review and update quarterly
6. Conduct tabletop exercises annually

During an incident:

1. Open this template immediately
2. Follow the phase-by-phase instructions
3. Use the checklists to ensure nothing is missed
4. Document everything in the Incident Log
5. Communicate using the pre-written templates

This template covers:

• Ransomware attacks
• Data breaches
• POS system compromises
• Metrc/compliance system failures
• Insider threats
• Physical security incidents with cyber components

SECTION 1: INCIDENT RESPONSE TEAM

1.1 Internal Team Contacts

Complete this section NOW, before any incident occurs.

1.2 External Contacts

1.3 Regulatory Contacts

1.4 Role Definitions

Incident Commander (IC)

• Overall authority during incident
• Makes final decisions on response actions
• Coordinates between all teams
• Authorizes communications and notifications
• Typically: Owner, GM, or designated senior manager

IT Lead

• Technical investigation and containment
• System isolation and recovery
• Evidence preservation
• Coordinates with external IT/security vendors
• Typically: IT manager, MSP primary contact

Operations Lead

• Maintains business continuity
• Manages staff during incident
• Coordinates manual workarounds
• Ensures customer service continues
• Typically: Store manager, operations director

Compliance Officer

• Regulatory notification requirements
• Documentation for auditors
• Metrc/BioTrack communication
• State regulator liaison
• Typically: Compliance manager, license holder

Communications Lead

• Internal staff communications
• Customer notifications
• Media inquiries
• Social media monitoring
• Typically: Marketing manager, owner

Legal Counsel

• Legal notification requirements
• Liability assessment
• Law enforcement coordination
• Contract review (insurance, vendors)
• Typically: Outside attorney

Cannabis Business Security Tools | cannabisrisk.diy

Comprehensive security tools, checklists, and compliance resources for cannabis businesses. Estimate breach costs, audit PoS, review vendor security, and more.

cannabisrisk.diy