Breach Response Data Management System and Method

An incident is created in response to a cyber event. One or more authorities are identified. At least some of the one or more authorities are associated with respective authority conditions and at least some of the respective authority conditions are associated with respective attributes. Satisfaction of the respective authority conditions of an authority identifies the authority. At least some of respective attributes are associated with the incident as incident attributes. Incident attribute values are received from a user for at least some of the incident attributes. Tasks are identified responsive to at least one of the incident attribute values satisfying respective task conditions of the identified tasks. The tasks are then associated with the incident.