Milwaukee, WI · Washington, DC · Boston, MA

  1. Crisis Mode
  2. Data Security Measures
    1. Preparing For The Inevitable
      1. Building a Data Breach Plan
        1. Planning for the Initial Response/Investigation
          1. Social Engineering
          2. Develop an Investigation Plan
          3. Involve Appropriate Company Resources
        2. Building a Notification Plan
          1. Understanding The Laws
            1. State Laws
          2. Who Must Be Notified?
          3. How Will Notifications Be Completed?
        3. Media Issues
          1. Media Plan
          2. Dealing With The Media
        4. Government Agency Issues
          1. Creating a Government Response Plan
          2. Dealing With Government Inquiries
          3. Developing Relationships
        5. Customer/Consumer Issues
          1. Customer Retention Plan
          2. Customer Response Plan
        6. Building Relationships with Vendors/Suppliers
      2. Implementing a Data Breach Plan
        1. Coordinating among Company Departments
        2. The Role of Legal Counsel
      3. Testing a Data Breach Plan
        1. Assessing the Plan
        2. Mock Exercises
        3. Alter/Update as Needed
      4. Assessing Your Data Breach Vulnerabilities
        1. Catalog Your Personal Information
        2. Developing a Company Training Process
        3. Understanding Privacy Promises
        4. Preparing for the Unexpected
        5. Assessments/Audits
        6. Establishing a Point of Responsibility
        7. The Role of Legal Counsel

Planning for the Initial Response/Investigation

The first few hours following the discovery of a data breach are critical. You have to stop the breach, ensure that the vulnerability cannot be exploited further, assess the damage, mitigate that damage to the extent possible, calm concerned management, and weather the notification process and potential customer or consumer backlash. The compressed time frame and sheer amount of work to be done require detailed planning well in advance of the incident. Lack of preparation unduly complicates the process and can create unnecessary exposure.

But can you plan for the unknown? Surprisingly, yes. The data breach incidents that have occurred in the past generally can be grouped into common categories. Preparations then can be made to respond if a breach occurs in a specific category. For instance, many data breaches have occurred due to hacking attacks that exploit some vulnerability in a computerized security system. In other incidents, customer or consumer information has been disclosed on the Internet because web pages containing this information were not adequately secured. Other incidents resulted from social engineering, where data thieves manipulated employees to gain access to otherwise secured systems. Lost laptops and the compromise of employee data represent another common occurrence.

Planning can make responding to these incidents smoother. And the right plan just may avoid costly liability in the future. The first step is to develop an Investigation Plan. To do that, you must involve appropriate company resources.

Click on the above links to learn more about planning for the initial response.