5 - This may be supported by [to be completed by Intervention and improvement intervention and improvement targeted security awareness [Company]] processes to existing business training or legal action. processes to prevent recurrence of the incident. a) [Head of the [IT 6 Preservation of evidence - If it is Consult with team / IT service decided to pursue a perpetrator of the cybersecurity and provider]] data breach it will be essential to take forensic experts before a forensic copy of the affected system 'touching' data potentially b) [Privacy Officer/Compliance immediately the security breach at issue. Manager] was detected as evidence of the Preserve all affected breach. system log including firewall, VPN, mail, network, client, web, server and intrusion detection system logs. a) [Head of the [IT 7 Documentation - Maintain adequate Record the date and time team / IT service documentation of the data breach. of the breach, the provider]] personnel who System logs are critical to assessing discovered the breach, the origins of the attack, its duration, the nature of the breach, and volume of data affected during the kinds of data the breach. This information can help stolen/lost, when the contribute to establish 'lessons response efforts began learned'. and all of the employees who had access to the affected systems. Cf. Schedule 1 for a template log form. Confirm that the security access has been terminated for any employee suspected to have been deliberately involved in the breach. 8 Engagement with stakeholders Consult below for a) [Head of the - It is important to specific notification affected (notification) effectively engage with those directly actions in relation to each departments] affected by the breach, or those who
5 Intervention and improvement - intervention and improvement processes to existing business processes to prevent recurrence of the incident. This may be supported by targeted security awareness training or legal action. [to be completed by [Company]] 6 Preservation of evidence - If it is decided to pursue a perpetrator of the data breach it will be essential to take a forensic copy of the affected system immediately the security breach was detected as evidence of the breach. Consult with cybersecurity and forensic experts before 'touching' data potentially at issue. Preserve all affected system log including firewall, VPN, mail, network, client, web, server and intrusion detection system logs. a) [Head of the [IT team / IT service provider]] b) [Privacy Officer/Compliance Manager] 7 Documentation - Maintain adequate documentation of the data breach. System logs are critical to assessing the origins of the attack, its duration, and volume of data affected during the breach. This information can help contribute to establish 'lessons learned'. Record the date and time of the breach, the personnel who discovered the breach, the nature of the breach, the kinds of data stolen/lost, when the response efforts began and all of the employees who had access to the affected systems. Cf. Schedule 1 for a template log form. Confirm that the security access has been terminated for any employee suspected to have been deliberately involved in the breach. a) [Head of the [IT team / IT service provider]] 8 Engagement with stakeholders (notification) - It is important to effectively engage with those directly affected by the breach, or those who Consult below for specific notification actions in relation to each a) [Head of the affected departments]
Data%20breach%20incident%20manual.DOCX