3 Grant relevant access permissions to members of [IT team / IT [Head of the IT Team / IT service provider] where required. service provider] 4 Communicate findings of the technical assessment to the [Head of the IT Team / IT [Privacy Officer/Compliance Manager]. service provider] 5 Request additional investigation by the [IT team / IT service [Privacy provider] of the data breach where required. Officer/Compliance Manager] Step 3 - Response Once the initial technical assessment of the data breach was carried out, the incident should be responded to in a manner appropriate to its characteristics and the circumstances surrounding the incident. Based on the findings of the technical assessment, the [to be completed by [Company]] will coordinate the response, and will report upon regular intervals to the [to be completed by [Company]], as agreed with the latter. If, based on the nature of the breach, it appears that email systems of [Company] may be compromised, it should be considered to communicate by telephone to prevent vital communications from leaking. STEP 3 - RESPONSE N° Overall action Specific action steps Owner 1 Internal review - Establish a breach Contact outside counsel a) [Head of the [IT response team and organise a to understand legal team / IT service meeting where you deliberate and implications of the provider]] discuss the facts known to date, breach and confirm a b) [Privacy including the nature of information legal strategy. Officer/Compliance accessed and extent of the access. Establish a privileged Manager] This typically includes details on breach response team c) other who was involved, what happened, portal to memorialize Stakeholders where it happened, when it happened, actions taken to provide depending on the how it happened and how [Company] legal advice and circumstances of can remediate the breach. direction. the data breach The discussions are to be on the (preliminary outline initial technical assessment provided of) breach response by the [Head of the [IT team / IT strategy, including any service provider]]. actions to be taken and ownership for each action.
3 Grant relevant access permissions to members of [IT team / IT service provider] where required. [Head of the IT Team / IT service provider] 4 Communicate findings of the technical assessment to the [Privacy Officer/Compliance Manager]. [Head of the IT Team / IT service provider] 5 Request additional investigation by the [IT team / IT service provider] of the data breach where required. [Privacy Officer/Compliance Manager] Step 3 - Response Once the initial technical assessment of the data breach was carried out, the incident should be responded to in a manner appropriate to its characteristics and the circumstances surrounding the incident. Based on the findings of the technical assessment, the [to be completed by [Company]] will coordinate the response, and will report upon regular intervals to the [to be completed by [Company]], as agreed with the latter. If, based on the nature of the breach, it appears that email systems of [Company] may be compromised, it should be considered to communicate by telephone to prevent vital communications from leaking. STEP 3 - RESPONSE N° Overall action Specific action steps Owner 1 Internal review - Establish a breach response team and organise a meeting where you deliberate and discuss the facts known to date, including the nature of information accessed and extent of the access. This typically includes details on who was involved, what happened, where it happened, when it happened, how it happened and how [Company] can remediate the breach. The discussions are to be on the initial technical assessment provided by the [Head of the [IT team / IT service provider]]. Contact outside counsel to understand legal implications of the breach and confirm a legal strategy. Establish a privileged breach response team portal to memorialize actions taken to provide legal advice and direction. (preliminary outline of) breach response strategy, including any actions to be taken and ownership for each action. a) [Head of the [IT team / IT service provider]] b) [Privacy Officer/Compliance Manager] c) other Stakeholders depending on the circumstances of the data breach
Data%20breach%20incident%20manual.DOCX