97 Things Every Information Security Professional Should Know

Chapter 38. Planning for Incident Response Customer Notifications

JR Aquino

Incident response is a discipline around managing a crisis. The core of this activity is to provide a central control point for information and alignment on execution using the best information available at the time. We should first start by disambiguating an internal incident versus a customer or third-party impacting incident, which requires notifications to those affected.

When harm has befallen your company’s data, infrastructure, or service(s) and there is no impact to third parties, upon remediation, the event could be considered contained and may only require internal recordkeeping for compliance purposes.

When harm has befallen your customer’s service, data, or personally identifiable data your company manages, you may have an obligation to report the incident to the impacted third parties and/or regulators. These are the cases that are most sensitive and require coordination to ensure that contractual, regulatory, and business obligations are all fulfilled.

It’s useful to note here that most incidents you encounter will have no “hacker” involved. Most of the incidents that you are likely to manage will be due to human error.

Let’s dive right in and establish the core fundamentals that you will need to prepare for a security incident that requires notifications.

Assume breach.

The first order ...