When to involve others.
WHEN TO INVOLVE SPECIALISTS
The matter is serious You lack the capability Evidence may be used in proceedings The compromise is extensive Regulatory notification is required
WHY CAPABILITY MATTERS
Investigation performed badly destroys the evidence and reaches wrong conclusions.
WHAT TO DO BEFORE THEY ARRIVE
Preserve what you can Stop using affected systems Record what has already been done
WHY RECORD WHAT WAS DONE
They must know what has been altered.
WHAT TO TELL THEM HONESTLY
Everything that was done, including mistakes.
WHY
Undisclosed actions produce wrong conclusions.
WHEN TO INVOLVE AUTHORITIES
Where a criminal offence appears to have occurred Where required by law Where you intend to pursue someone
WHAT TO ESTABLISH
Whether reporting is required or discretionary.
WHY IT MATTERS
Some matters carry reporting obligations with short deadlines.
WHAT TO CONSIDER BEFORE REPORTING
That control of the matter passes partly to them That equipment may be taken That timescales are not yours
WHAT TO PREPARE
A clear account of what happened Evidence, preserved properly A contact
WHAT REGULATORY NOTIFICATION TYPICALLY REQUIRES
What happened What data was affected How many people What you have done What you will do
WHAT TO ESTABLISH
The deadline.
WHY
Notification deadlines for data breaches are short.
WHAT TO AVOID
Delaying notification while investigating.
WHY
Obligations frequently require notification before all facts are known.
