Published September 22, 2026
Research question
What administrative evidence should a manufactured-home operator preserve when resident, applicant, employee, or vendor data may have been exposed?
Bottom line
A breach response file must support action without spreading the compromised information again. The FTC recommends securing operations, mobilizing experts, preserving evidence, identifying what happened and what data was affected, fixing vulnerabilities, coordinating with appropriate parties, and communicating accurately. State notification laws and sector-specific rules can impose different duties, so legal counsel must direct notification decisions. A virtual assistant can manage a restricted action log and approved communications, but should never investigate systems independently, erase evidence, or improvise a notice.
Method and evidence standard
This study reviewed current public guidance from the named federal agencies on September 21, 2026. It translates source requirements and recommendations into an administrative control file for manufactured-home community operations. It does not test a particular community, vendor, applicant, appliance, tax return, or incident. It does not treat agency guidance as a substitute for the controlling statute, regulation, contract, state law, local ordinance, program rule, or professional advice.
Verified facts below are attributed to the source that states them. The proposed fields, queues, review steps, and role boundaries are MobileHomeBiz analysis based on those sources. Where a duty depends on facts not available to the administrator, the workflow records the uncertainty and routes it to the qualified owner. That distinction matters: a complete checklist can show disciplined administration, but it cannot certify legal compliance, technical safety, tax treatment, or fair-housing legality.
Open a restricted incident record
Assign an incident ID, detection time, reporter, affected system or physical area, initial description, incident commander, legal contact, technical lead, and access list. Store the file outside the suspected compromised system when experts direct that approach. Use neutral language such as suspected exposure until facts are established. Do not paste resident Social Security numbers, bank details, screening reports, or passwords into the action log. Refer to protected evidence by identifier.
Contain without destroying evidence
FTC guidance says to move quickly to secure systems and stop additional loss, while warning against destroying forensic evidence. The response lead should decide whether to isolate devices, change credentials, suspend vendor access, secure rooms, or remove exposed web content. Staff should record who authorized each action, when it occurred, and what evidence was preserved. Turning off a device or deleting files can damage an investigation, so an assistant should follow expert instructions rather than apply a generic checklist.
Establish scope and facts
The investigation record should identify systems, dates, access logs, accounts, data categories, affected people, encryption status, service providers, and known misuse. Separate confirmed facts from hypotheses and open questions. Track each evidence request and source. The FTC recommends reviewing logs and access, determining what information was compromised, and documenting the investigation. A changing estimate is normal; retain revisions with timestamps rather than rewriting the first estimate.
Legal and notification decision log
The FTC notes that every state, the District of Columbia, Puerto Rico, and the Virgin Islands has breach-notification legislation, and other rules may apply depending on the information and business. Counsel should document jurisdictions, triggering definitions, timing, recipients, law-enforcement coordination, regulator filings, and approved notice text. The operations file records the decision and authority but does not attempt a fifty-state legal analysis. If notification is delayed, preserve the authorized reason and owner.
Resident and applicant communications
Use accurate, plain-language, approved messages that explain what is known, the information involved, actions taken, protective steps, and a reliable contact channel. The FTC warns against misleading statements and recommends telling people how future communications will occur, which can reduce phishing risk. Track recipient population, address source, language and accessibility needs, delivery channel, sent time, bounces, returned mail, hotline scripts, updates, and complaints. Never promise that no harm will occur.
Vendor and recovery work
If a service provider was involved, record its access, contractual contacts, containment statement, forensic findings, remediation, and verification. Revoke unneeded access and confirm fixes through the technical lead. Recovery includes restoring clean systems, monitoring, completing corrective actions, revising the incident plan, and documenting lessons learned. Close only when the incident commander approves closure and assigns any longer-term work. A closed communications task is not the same as a closed security incident.