3 Grant relevant access permissions to members of [IT team / IT service provider] where required. [Head of the IT Team / IT service provider] 4 Communicate findings of the technical assessment to the [Privacy Officer/Compliance Manager]. [Head of the IT Team / IT service provider] 5 Request additional investigation by the [IT team / IT service provider] of the data breach where required. [Privacy Officer/Compliance Manager] Step 3 - Response Once the initial technical assessment of the data breach was carried out, the incident should be responded to in a manner appropriate to its characteristics and the circumstances surrounding the incident. Based on the findings of the technical assessment, the [to be completed by [Company]] will coordinate the response, and will report upon regular intervals to the [to be completed by [Company]], as agreed with the latter. If, based on the nature of the breach, it appears that email systems of [Company] may be compromised, it should be considered to communicate by telephone to prevent vital communications from leaking. STEP 3 - RESPONSE N° Overall action Specific action steps Owner 1 Internal review - Establish a breach response team and organise a meeting where you deliberate and discuss the facts known to date, including the nature of information accessed and extent of the access. This typically includes details on who was involved, what happened, where it happened, when it happened, how it happened and how [Company] can remediate the breach. The discussions are to be on the initial technical assessment provided by the [Head of the [IT team / IT service provider]]. Contact outside counsel to understand legal implications of the breach and confirm a legal strategy. Establish a privileged breach response team portal to memorialize actions taken to provide legal advice and direction. (preliminary outline of) breach response strategy, including any actions to be taken and ownership for each action. a) [Head of the [IT team / IT service provider]] b) [Privacy Officer/Compliance Manager] c) other Stakeholders depending on the circumstances of the data breach
2 Investigation - The team must assess whether the information and findings gathered so far in relation to the breach are sufficient to understand the nature of the incident, the impact on the organisation (in terms of legal liability, reputational damage, financial impact, organisational impact and other risk factors), and help establish the underlying cause and impacted stakeholders. Brief the team about containment, status of investigation, and other relevant aspects. Assess completeness and accurateness of information gathered so far. Where required: order additional investigation from [IT team / IT service provider] staff, external cybersecurity and/or forensic experts. Determine how to address the breach while ensuring or restoring business continuity. Identify the individuals who were involved in the discovery and initial investigation of the breach. Document their actions and findings, and organise interviews with these persons, as necessary, to obtain any missing information. Taking into account the status of the investigation, consider notifying the the Executive Committee and Board of Directors, as appropriate [OPTIONAL]. a) [Head of the [IT team / IT service provider]][By retaining external experts, communications prepared for or by the external experts can be protected by the attorney-client privilege.] b) [Privacy Officer/Compliance Manager] c) Stakeholders depending on the circumstances of the data breach 3 Containment - Agree on steps to be taken to contain the breach to prevent any further data loss or security compromises. If the breach is ongoing, consult with forensic experts [and trained [Information Security] staff] about taking affected systems offline a) [Head of the [IT team / IT service provider]][By retaining external experts via Legal, communications
5 Intervention and improvement - intervention and improvement processes to existing business processes to prevent recurrence of the incident. This may be supported by targeted security awareness training or legal action. [to be completed by [Company]] 6 Preservation of evidence - If it is decided to pursue a perpetrator of the data breach it will be essential to take a forensic copy of the affected system immediately the security breach was detected as evidence of the breach. Consult with cybersecurity and forensic experts before 'touching' data potentially at issue. Preserve all affected system log including firewall, VPN, mail, network, client, web, server and intrusion detection system logs. a) [Head of the [IT team / IT service provider]] b) [Privacy Officer/Compliance Manager] 7 Documentation - Maintain adequate documentation of the data breach. System logs are critical to assessing the origins of the attack, its duration, and volume of data affected during the breach. This information can help contribute to establish 'lessons learned'. Record the date and time of the breach, the personnel who discovered the breach, the nature of the breach, the kinds of data stolen/lost, when the response efforts began and all of the employees who had access to the affected systems. Cf. Schedule 1 for a template log form. Confirm that the security access has been terminated for any employee suspected to have been deliberately involved in the breach. a) [Head of the [IT team / IT service provider]] 8 Engagement with stakeholders (notification) - It is important to effectively engage with those directly affected by the breach, or those who Consult below for specific notification actions in relation to each a) [Head of the affected departments]
may have a wider interest in management of the breach. This is likely to include employees, the media, clients and appropriate regulators or law enforcement agencies. An engagement plan should be agreed at the earliest opportunity. Please note that depending on the particular circumstances and on the legal advice gained from local outside counsel, it may be legally required to notify the persons affected, law enforcement and/or regulators at an earlier stage and more specifically within 72 hours for data breaches affecting European entities. Please refer to the table below for more information. category of individual or authority concerned. Determine who has responsibility for notification ([Company], or a client or vendor). Develop engagement / communications plan. b) [Privacy Officer/Compliance Manager] c) other Stakeholders depending on the circumstances of the data breach (e.g. in this case Legal department, Human Resources.) 9 Continue convening team meetings, as required. Continue reviewing breach response strategy and progress on actions list. Breach response team 10 Continue updating the Executive Committee and Board of Directors, as appropriate. N/A [Privacy Officer/Compliance Manager] Notification and engagement with stakeholders In relation to notification, guidance from [the Legal department / external legal counsel] must be sought before engaging with staff or any external stakeholders to ensure information disclosed is accurate and does not expose us to undue risk. The [the Legal department / external legal counsel] will determine whether and how to notify data breaches, as notification requirements vary and inappropriate action may result in enforcement action. The table below provides an overview of best practices in relation to notifying the stakeholders. Notification of, or engagement with these stakeholders should take place in strict compliance with the engagement plan developed by the breach response team, and only by those persons explicitly authorised for such engagement. With the exception of personnel, we should carefully evaluate when to notify or communicate to the affected individuals, other third parties and authorities when this is not legally or contractually required.
Was the level of the response appropriate? any lessons be learnt from the incident? 8 Add output of the post-incident review meeting to the Incident Report. N/A Breach response team 9 Review operational controls and update as necessary. This may include revising data collection controls, training, etc. [Head of the [IT team / IT service provider]] 10 Review training of all personnel, including [IT team / IT service provider], and update as necessary. Remind the appropriate parties that potential concerns about incidents must be notified to the [Privacy Officer/Compliance Manager]. [Privacy Officer/Compliance Manager] / HR Review and updates All updates in response to applicable regulations, internal operational procedures or other requirements shall be made promptly by the [Privacy Officer/Compliance Manager], who will review and obtain approval from the breach response team for all updates to this Manual within a reasonable timeframe. For questions about this Manual, contact [Privacy Officer/Compliance Manager] at [insert contact details].