the extent of the breach, i.e. how many individuals are affected the harms to affected individuals that could potentially be caused by the breach how the breach can be contained The Executive Committee will determine the severity of the incident using the reference table on the next page and by completing the Data Breach Severity Form below (i.e. to decide if the incident can be managed and controlled locally or if it is necessary to escalate the incident to the (ICO). The severity of the incident will be categorised on a scale of 0 to 6. Rating 0 1 2 3 4 5 6 No significant reflection on any individual or body Media interest very unlikely. Damage to an reputation. Possible media interest (e.g. prominent member of the Charity involved). Damage to a Scout Group, District, reputation. Some local or national subject specific media interest that may not go public. Damage to the Charity’s reputation. Low key local or national media coverage. Damage to The Scout reputation. Local media coverage. Damage to The Scout National media Monetary penalty Imposed by ICO. Clients affected Minor breach of Only a single individual affected. Potentially serious breach. Less than five individuals affected, or risk assessed as low (e.g. files were Serious potential breach and risk assessed high (e.g. records lost) Up to 20 Serious breach of e.g. up to 100 individuals affected and/or identifiable or particularly sensitive ie Serious breach with either a particular sensitivity (e.g. sexual or mental health details, or up to 1000 individuals affected. Serious breach with potential for ID theft or over 1000 affected. to injured parties. Other Liabilities. Additional security. Legal costs. .
individuals affected. Maintain internal to members. Inform TSA Maintain internal to the members. Inform TSA Maintain internal to the members. Also inform the individuals affected as well as the ICO. Inform TSA Maintain internal to the members. Also inform the individuals affected as well as the ICO. Inform TSA Maintain internal to the members. Also inform the individuals affected as well as the ICO. Inform TSA Maintain internal to the Also inform the affected as well as the ICO. Inform TSA Maintain internal to the members. Also inform the individuals affected as well as the ICO. Inform TSA Step 2: Containment and Recovery Once it has been established that a data breach has occurred, the Executive Committee needs to take immediate and appropriate action to limit the breach. The Executive Committee will: Establish who within the Scout Group, District, County/Area/Region needs to be made aware of the breach and inform them of what they are expected to do to contain the breach (for example finding a lost piece of equipment, changing access codes on doors, isolating/closing a compromised section of the network, etc) Establish whether there is anything that can be done to recover any losses and limit the damage the breach can cause (for example physical recovery of equipment/records, the use of back-ups to restore lost/damaged data) Establish if it is appropriate to notify affected individuals immediately (for example where there is a high level of risk of serious harm to individuals) Where appropriate (for example in cases involving theft or other criminal activity), inform the police. Step 3: Risk Assessment