Privacy and Security Breach and Incident Management
What this domain tests
Incident management asks whether you can prepare for, detect, contain, assess, notify, and learn from a breach. Distinguish an event (an observable occurrence), an incident (an event that threatens confidentiality, integrity, or availability), and a breach (an incident that triggers legal notification duties). Know the incident-response lifecycle: prepare, detect/analyze, contain, eradicate, recover, and post-incident review.
Concepts to master
- The breach assessment: what data, whose data, how many individuals, was it secured/encrypted, and what is the harm? These facts drive notification decisions.
- Notification obligations: who must be told (individuals, regulators, law enforcement, business partners), timelines, and content requirements-driven by the applicable law or contract.
- Containment vs. evidence preservation: don't destroy logs while stopping the attack.
- Documentation: a timeline, decisions, and rationale are essential for regulators and for improvement.
- Communication: a single designated spokesperson; avoid speculation in notices.
- Lessons learned: root-cause analysis feeding back into risk management.
Traps
- Notifying too broadly or too narrowly because the assessment skipped data classification.
- Choosing "wait and investigate" when a legal timeline is already running.
- Deleting or overwriting evidence during containment.
- Confusing internal escalation with external notification; both are needed, in the right order.
- Assuming a low harm threshold means no notice-the applicable rule controls.
Rule of thumb
When a question presents a live incident, the sequence is: contain and preserve evidence → assess scope and applicable obligations → notify per the controlling law/contract → document and review. Never skip the assessment before notifying.
Worked example: A lost encrypted laptop with a strong key. The correct analysis confirms the data was rendered unusable via encryption, documents the assessment, and applies the applicable rule's secured-data exception-rather than notifying automatically or assuming no action is needed.