Legal, Regulatory, and Ethical Considerations
Incident response decisions have legal consequences, and the exam expects you to recognise obligations without pretending to give legal advice.
Evidence and duty of care
- Maintain chain of custody: log every transfer of a device or image, use write blockers, hash images at acquisition, and store copies securely.
- Follow your organisation's monitoring and acceptable-use policy - collecting data outside stated authorisation can taint evidence and breach privacy law.
- Involve counsel early; in many jurisdictions counsel-directed work can be protected by privilege, which affects how reports are written and circulated.
Notification landscape
Deadlines differ by regime and sector, so memorise the shape, not just the number:
- GDPR: supervisory authority notification within 72 hours of becoming aware of a personal data breach, where feasible.
- HIPAA: affected individuals generally within 60 days of discovery.
- SEC: material cybersecurity incidents disclosed on Form 8-K generally within four business days of the materiality determination (public companies).
- NIS2 (EU): early warning within 24 hours, incident notification within 72 hours, final report later.
- PCI DSS and most contracts require prompt notice to acquirers, card brands, or customers.
- Ransom payments may trigger sanctions screening obligations and, in some jurisdictions, mandatory reporting.
Ethics and limits
Stay inside authorisation: no hacking back, no accessing systems you do not own, no retaliation. Minimise harm - collect only what the investigation needs. Protect reporters and whistleblowers. Document decisions and the reasoning behind them.
Worked example
A breach exposes EU customer records and US patient records. The team confirms the incident Tuesday at 10:00 UTC. The 72-hour GDPR clock starts at awareness, not at confirmation of scope, so the authority notification is drafted in parallel with scoping, stating what is known and what is not. HIPAA's 60-day clock allows fuller investigation. One incident, two clocks, two different messages - each logged.
Traps
- Missing a deadline because you waited for complete facts; most regimes allow phased notification.
- Assuming one jurisdiction's deadline applies everywhere.
- Giving legal conclusions in the incident report instead of routing to counsel.
- Promising confidentiality to a regulator or customer you cannot bind.
- Deleting data to "clean up" while a preservation duty is active.