Incident Management, Reporting, and Remediation
This domain tests incident handling from detection to closure, especially the clock-based obligations where a missed deadline creates a separate violation.
Definitions
An event is an observable occurrence; an incident is an event that threatens operations, data, or obligations; a personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data. Not every incident is a breach, and not every breach is reportable.
Lifecycle
Prepare, detect and analyse, contain, eradicate, recover, then post-incident review. Named roles should exist in advance: incident commander, legal, privacy, communications, and IT.
Notification clocks
- GDPR Art 33: notify the supervisory authority within 72 hours of becoming aware, unless unlikely to result in a risk. Art 34: notify data subjects without undue delay where there is high risk.
- NIS2: early warning within 24 hours, incident notification within 72 hours, final report within one month.
- SEC Form 8-K Item 1.05: within four business days of determining materiality.
- HIPAA: 60 days; contracts such as PCI DSS and bank outsourcing terms impose their own deadlines. Awareness - a reasonable degree of certainty that a reportable breach occurred - starts most clocks, not the first system alert.
Remediation
Root-cause analysis, a corrective action plan with an owner and due date, verification that the fix worked, and trend reporting to the board.
Worked example
Ransomware hits a subsidiary server on Day 0 at 09:00 and containment begins. On Day 1 at 10:00, forensics confirms EU customer data was exfiltrated; the 72-hour GDPR clock starts then, so the notification is due by Day 4 at 10:00. If the entity is in NIS2 scope, the 24-hour early warning runs from the same awareness point. The parent determines materiality on Day 5 and files the 8-K within four business days.
Traps that cost marks
- Starting the GDPR clock at the first alert rather than at awareness of a reportable breach.
- Assuming containment ends the notification obligation.
- Declaring "no exfiltration" without forensic evidence.
- Closing remediation without retesting effectiveness.