Managing Catastrophic Loss of Sensitive Data

Chapter 8. Disclosure and Notification

Solutions in this chapter:

• Notification Threshold

• Identifying Notification Recipients

• Timing

• Source

• Contents

• Protection Recommendations

• Offered Services

• Method of Delivery

• Other Notifications

• Legal Issues and Requirements

• Preparing for Follow-Up

Summary

Introduction

All organizations have an affirmative duty to protect sensitive information against unauthorized access or use. Notifying affected parties of a security incident involving their information is a key part of that duty. Once the organization becomes aware of an incident of unauthorized access to sensitive information, and once an investigation determines that misuse ...