Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Incidents and regulatory notification

Deciding what counts as an incident, who can act, when regulators must hear, and when a service is safe to reconnect.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we decide whether something is an incident or just an event?
  2. How do we decide which decisions an incident exercise should test?
  3. How do we run a tabletop that tests decisions rather than rehearsing a script?
  4. How do we decide an incident's severity when the facts are still unclear?
  5. How do we decide whether an incident is significant under NIS2?
  6. How do we decide whether an ICT incident is major under DORA?
  7. How do we write a NIS2 early warning when we still know very little?
  8. How do we make sure we can notify a regulator before an incident happens?

When do we…

Triggers and timing: when something has to happen.

  1. When do we have to notify a regulator, and under which regime?
  2. When one incident triggers NIS2, DORA and GDPR at once, which clock runs first?
  3. When do we tell the board during an incident?
  4. When do we call in outside incident-response help?
  5. When does each group of people need an incident exercise, and how often?
  6. When is a post-incident review needed, and what must it produce?
  7. When must we tell people affected by a personal data breach, and what do we tell them?

Who decides…

Authority: who may approve, accept or act.

  1. Who has the authority to take a production system offline?
  2. Who decides whether to pay a ransom?
  3. Who should facilitate, observe and take part in an incident exercise?
  4. Who approves and submits a regulatory notification, including out of hours?

If…, then how…

Situations: something has happened, what now.

  1. If a VPN appliance may be compromised, do we patch, rebuild or replace it?
  2. If a service was compromised, what evidence is enough to reconnect it?
  3. If ransomware has encrypted production, do we restore or rebuild?
  4. If a payment has gone to a fraudster, then what do we do in the first hour?
  5. If an exercise finds a gap, then how do we make sure it is fixed and stays fixed?
  6. If we can't tell whether an incident is reportable and the deadline is close, then what?

Other categories