Incident Response, Breach Notification, and Security Safeguards
What this domain tests
This domain tests incident response and breach notification: how to distinguish an incident from a reportable breach, scope it, contain it, and notify within the correct deadlines and to the correct parties.
Core rules and concepts
- Incident vs breach: an incident is any security event; a breach is unauthorized acquisition or access that triggers legal notification. Notification triggers vary: some states use a harm threshold, others treat unauthorized access to personal information as a breach.
- State breach laws: all 50 states have laws, but definitions, deadlines, AG thresholds, credit monitoring, and content requirements differ. Typical consumer notice is without unreasonable delay; some statutes specify 30, 45, or 60 days.
- Sectoral: HIPAA requires notification without unreasonable delay and no later than 60 days; HITECH adds media and HHS notice for large breaches. GLBA has safeguards and notice expectations; the FTC Health Breach Notification Rule covers certain health apps.
- Security safeguards: reasonable administrative, technical, and physical controls-MFA, encryption, least privilege, logging, patching, vendor oversight.
- Response lifecycle: prepare, detect, contain, eradicate, recover, notify, learn.
Worked example
An unencrypted laptop with 5,000 customer SSNs is stolen from an employee car. The team contains access, preserves logs, and assesses encryption and misuse. Because SSNs are involved and the laptop was unencrypted, multiple state laws are triggered; the company notifies consumers and required AGs, offers credit monitoring where required, and reviews device controls.
Traps that cost marks
- Waiting for confirmed fraud before notifying; most laws require prompt notice.
- Notifying only the company’s home state; affected individuals’ states apply.
- Assuming encryption safe harbor applies if the laptop was unlocked or keys were stolen.
- Forgetting processor-to-controller notice obligations in vendor contracts.