Incident Response, Breach Notification, and Forensics
What this domain tests
This domain combines process, legal clock and evidence handling. Questions typically hinge on when the notification clock starts, whether notification is required, and what evidence must be preserved before remediation destroys it.
Core rules
- Lifecycle (NIST SP 800-61). Preparation; detection and analysis; containment, eradication and recovery; post-incident activity. Playbooks, contact trees and tabletop exercises belong to preparation.
- Breach definition (Art 4(12)). A breach is a confidentiality, integrity or availability failure, including accidental loss and ransomware.
- Art 33. Notify the supervisory authority within 72 hours of becoming aware, unless unlikely to result in a risk to rights and freedoms. Phased notification is permitted. Processors notify controllers without undue delay (Art 33(2)).
- Art 34. Notify affected individuals without undue delay where there is a high risk, with exceptions for encryption, later measures that remove the risk, or disproportionate effort requiring public communication.
- Records (Art 33(5)). Every breach is logged, including those not notified, with facts, effects and remedial action.
- Risk assessment. Consider the nature and volume of data, identifiability, special categories, consequences and likelihood.
- Forensics. Chain of custody, hashed images, write blockers, order of volatility (RFC 3227), preserved logs, legal privilege where counsel directs the investigation.
Worked example
Ransomware encrypts a file server holding HR records. This is an availability breach. The 72-hour clock starts when the organisation becomes aware of the breach, not when the attack began or when the investigation concludes. Risk is assessed on the exposed categories and volume; if high risk is likely, both the authority and individuals are notified. Before rebuilding, investigators image the disks with a write blocker and hash the images. Even if the final decision is not to notify, the reasoning is recorded in the breach register. Reasoning: classify, clock, risk, notify, document, preserve.
Traps that cost marks
Starting the clock at attack time rather than awareness; assuming encryption removes the duty when keys may be compromised; forgetting the processor-to-controller duty; rebuilding systems before imaging evidence; failing to document non-notifiable breaches.