# Event website defacement: response decision card

Use with the event's security or hosting responder and existing incident plan. Record facts, decisions, owners and evidence references. This is not a breach determination, a forensic procedure or authorization to test systems.

## Incident header

| Field | Record |
|---|---|
| Incident ID and decision owner | |
| Reporter and first observed time with time zone | |
| Exact affected URLs and language versions | |
| Approved version or deployment reference | |
| Visible change; screenshot/evidence location | |
| Last known good observation | |
| Security responder and hosting/provider contact | |
| Next decision review time | |

## Immediate verification

- [ ] Compare the changed public page with the approved source; distinguish an unauthorized change, editorial mistake and stale cache.
- [ ] Preserve relevant screenshots and logs using the incident team's evidence procedure; avoid altering the original evidence copy.
- [ ] Check event facts, registration entry, ticket/checkout destination, help links and other affected language versions.
- [ ] Record what is known, unknown and assumed. Do not infer actor, cause or data loss from appearance alone.

## Containment decision

| Question | Evidence / decision | Owner | Time |
|---|---|---|---|
| Which exact pages or services are affected? | | | |
| Could visitors be sent to a malicious link or script? | | | |
| Which scoped control is approved: page withdrawal, trusted maintenance page, access restriction or other? | | | |
| Is the event domain or its email channel trustworthy for updates? | | | |
| Where is the separately verified attendee status/contact channel? | | | |
| What confirmed impact and next update time can be stated? | | | |

## Investigation and recovery gate

| Gate | Evidence / decision | Owner | Time |
|---|---|---|---|
| CMS/account, code/deploy, hosting and DNS/CDN changes reviewed | | | |
| Likely entry path contained or open question escalated | | | |
| Systems and period assessed for possible data exposure | | | |
| Legal/privacy notification review, if needed | | | |
| Proposed clean release or backup reviewed | | | |
| Recovery approved, rollback option recorded | | | |

## Public journey verification

- [ ] All affected URLs and six site languages show the approved content.
- [ ] Event date, venue, access and schedule details match the source of truth.
- [ ] Registration form and confirmation path work as expected.
- [ ] Each ticket button leads to the independently verified external destination.
- [ ] Contact and attendee status channel remain reachable.
- [ ] Responder records monitoring owner, recurrence signals and next review time.

## Decision log

| Time and time zone | Observation or action | Evidence link | Decision and reason | Owner | Next review |
|---|---|---|---|---|---|
| | | | | | |
| | | | | | |

Review jurisdiction-specific reporting obligations with qualified counsel. A visible defacement alone neither proves nor excludes personal-data exposure.