Cyber Incident Response and Breach Notification Law
Domain 3: Cyber Incident Response and Breach Notification Law
This domain tests the legal clock: when an incident becomes a notifiable breach, who must be told, in what order, and what evidence supports the decision. It combines incident-response discipline with overlapping state, federal, sector, and contractual duties.
Response discipline
Use a documented lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident review. Legal and privacy counsel should join the severity call, not after notification deadlines are missed. Preserve logs and images, start a legal hold, and record decision times, facts known, and uncertainty. Privilege can protect counsel-directed forensic work, but routine business records and independently created incident reports may not be privileged.
Notification triggers
- U.S. state breach laws: definitions of personal information and "breach" vary; many require notice to affected residents and the attorney general, sometimes consumer reporting agencies, without unreasonable delay or within a set number of days. Encryption safe harbors usually fail if the key is also compromised.
- HIPAA: covered entity notifies individuals without unreasonable delay and no later than 60 days after discovery; HHS notice follows, with media notice for breaches affecting more than 500 residents of a state or jurisdiction. Business associates notify the covered entity without unreasonable delay and no later than 60 days.
- GDPR: controller notifies the supervisory authority within 72 hours of awareness unless unlikely to result in a risk; affected individuals without undue delay where high risk. Processors notify controllers without undue delay.
- SEC: public companies file Form 8-K Item 1.05 within four business days after determining a cybersecurity incident is material.
- Contracts may impose shorter clocks: payment brands, insurers, cloud customers, and BAA/DPA terms.
Worked example
A ransomware attack exfiltrates unencrypted names and SSNs of 12,000 U.S. customers and 300 EU users; the company is SEC-reporting. Counsel confirms materiality on Day 3. The SEC clock starts then, not at initial detection. State clocks start under each state's discovery standard; GDPR's 72 hours starts at awareness. HIPAA is not triggered unless PHI is involved. Notify law enforcement if appropriate, but do not let that delay required notices.
Traps
- Starting every clock at the same event.
- Assuming encryption ends the analysis when keys were stolen.
- Missing processor-to-controller notice.
- Overlooking attorney general, media, or contractual notices.
- Letting forensic uncertainty become indefinite delay.