Incident Response, Breach Notification, and Monitoring
The clock starts at awareness, not at confirmation
This domain tests whether the organization can detect, assess, contain, notify, and learn from incidents. Candidates should know the phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Privacy-specific elements include a triage step to determine whether personal data was involved and which jurisdictions and thresholds apply, a notification decision record, and communication templates for regulators and affected individuals.
Notification obligations vary: some regimes require notice to a regulator within a fixed short period, some require notice only where there is a risk to individuals, and some require notice to individuals without undue delay. The auditor should not memorize one regime's numbers as universal; instead, verify that the organization has mapped its obligations by jurisdiction and can apply them quickly.
The classic trap is the incident log that records only confirmed breaches, omitting near misses and contained events that still required assessment. Another is testing tabletop exercises without checking whether lessons were implemented. Monitoring controls deserve scrutiny too: alerting that nobody reviews, or review queues with no evidence of triage.
Worked example. A lost laptop is logged as "no breach" because full-disk encryption was believed active. The auditor samples device configuration and finds 6% of laptops lack enforced encryption. The assessment was wrong, and the finding addresses both the technical gap and the triage process that accepted an unverified assumption.
Rule of thumb: for every incident, ask what data was involved, when the organization knew, what it decided, and who approved the decision.