Reporting, Communication, and Compliance
Reporting, Communication, and Compliance
This domain tests whether you can turn technical findings into accurate, timely, and legally aware communication. OSIR-style questions often ask who must be notified, what belongs in an incident report, and which deadline applies.
Core rules and concepts
- An incident report should state scope, timeline, affected assets and data, root cause, containment and recovery status, evidence references, and open actions. Separate confirmed facts from hypotheses.
- Stakeholder communication is role-based: executives need impact and decisions; technical teams need indicators and actions; legal and privacy need data types, jurisdictions, and timelines.
- Regulatory deadlines are specific. GDPR Article 33 generally requires supervisory-authority notification within 72 hours of awareness for qualifying personal-data breaches. HIPAA breach notification generally requires individual notice without unreasonable delay and no later than 60 days. PCI DSS notification follows acquirer and card-brand rules.
- Preserve legal privilege where counsel directs the investigation; do not over-share sensitive details in wide distribution lists.
- Track MTTD and MTTR, but also track containment time and recurrence. Post-incident reviews should produce owned, dated actions.
Worked example
A stolen laptop contains unencrypted customer records. Reasoning: confirm whether the disk was encrypted and whether the data was recoverable. If unencrypted personal data was involved, engage privacy/legal immediately, assess GDPR or HIPAA obligations, and start the notification clock. Draft an internal report with the known timeline, data elements, affected population estimate, and containment steps. Notify only approved recipients; do not publish technical indicators that could compromise the investigation. Close with lessons learned and evidence retention decisions.
Traps
Do not delay legal review to finish the technical write-up; do not send one message to every stakeholder; do not miss jurisdiction-specific deadlines; do not claim root cause before validation.