2 - The team must assess Brief the team about a) [Head of the [IT Investigation whether the information and findings containment, status of team / IT service gathered so far in relation to the investigation, and other provider]][By breach are sufficient to understand relevant aspects. retaining external the nature of the incident, the impact experts, Assess completeness and on the organisation (in terms of legal communications accurateness of liability, reputational damage, prepared for or by information gathered so financial impact, organisational the external experts far. impact and other risk factors), and can be protected by Where required: order help establish the underlying cause the attorney-client additional investigation and impacted stakeholders. privilege.] from [IT team / IT b) [Privacy service provider] staff, Officer/Compliance external cybersecurity Manager] and/or forensic experts. c) Determine how to Stakeholders address the breach while depending on the ensuring or restoring circumstances of business continuity. the data breach Identify the individuals who were involved in the discovery and initial investigation of the breach. Document their actions and findings, and organise interviews with these persons, as necessary, to obtain any missing information. Taking into account the status of the investigation, consider notifying the the Executive Committee and Board of Directors, as appropriate [OPTIONAL]. 3 Containment - Agree on steps to be If the breach is ongoing, a) [Head of the [IT taken to contain the breach to prevent consult with forensic team / IT service any further data loss or security experts [and trained provider]][By compromises. [Information Security] retaining external staff] about taking experts via Legal, affected systems offline communications
2 Investigation - The team must assess whether the information and findings gathered so far in relation to the breach are sufficient to understand the nature of the incident, the impact on the organisation (in terms of legal liability, reputational damage, financial impact, organisational impact and other risk factors), and help establish the underlying cause and impacted stakeholders. Brief the team about containment, status of investigation, and other relevant aspects. Assess completeness and accurateness of information gathered so far. Where required: order additional investigation from [IT team / IT service provider] staff, external cybersecurity and/or forensic experts. Determine how to address the breach while ensuring or restoring business continuity. Identify the individuals who were involved in the discovery and initial investigation of the breach. Document their actions and findings, and organise interviews with these persons, as necessary, to obtain any missing information. Taking into account the status of the investigation, consider notifying the the Executive Committee and Board of Directors, as appropriate [OPTIONAL]. a) [Head of the [IT team / IT service provider]][By retaining external experts, communications prepared for or by the external experts can be protected by the attorney-client privilege.] b) [Privacy Officer/Compliance Manager] c) Stakeholders depending on the circumstances of the data breach 3 Containment - Agree on steps to be taken to contain the breach to prevent any further data loss or security compromises. If the breach is ongoing, consult with forensic experts [and trained [Information Security] staff] about taking affected systems offline a) [Head of the [IT team / IT service provider]][By retaining external experts via Legal, communications
Data%20breach%20incident%20manual.DOCX