Supporting Incident Response Teams

In today’s rapidly-expanding digital economy, cyber security breaches occur every day supporting the need for an incident response team. And data security risks extend beyond the immense task of fixing a breach and notifying impacted customers for organizations conducting business with customers in the U.S., the U.K., the EU, and other jurisdictions with specific data privacy regulations. 

With an ever-growing myriad of regulations designed to protect consumers from harm and hold businesses accountable, organizations must contemplate and prepare for additional threats. Legal liability, regulatory penalties, and other repercussions are very real consequences for companies that fail to promptly and properly address data breaches. 

In addition, businesses also risk negative publicity and the loss of customer trust. The resulting reputational harm can make it difficult to attract and retain new customers in the future.

While data breaches involving a company’s confidential information or its customers’ personal information will inevitably cause disruption, an organization with a strong incident response plan will be better equipped to minimize downtime and control expenses associated with addressing the breach. Organizations’ incident response plans should include, at a minimum, the following key elements:

• Creation of an incident response team;
• Documentation of team members’ proposed roles and responsibilities in a breach situation, as well as identification of required tools needed to address the breach;
• Review of information affected by the breach to identify the extent of the breach and the impacted consumers; 
• A containment plan to limit the impact of a breach;
• Mechanisms to copy affected networks and systems;
• Removal of affected systems;
• Testing to confirm containment, removal, and recovery;
• Current breach notification requirements in the jurisdictions in which the company operates and in which its customers live;
• Consumer notifications designed to comply with all applicable laws and regulations;
• Notifications to law enforcement, industry regulators, state attorney generals, and others (as required);
• A data retention policy that addresses documenting the breach and preserving  attorney-client privilege; and
• Preparation for potential litigation related to the breach.

Some of the specific elements of an incident response plan are situation-specific. However, organizations can prepare many of these items in the abstract. When key players understand the scope and required components of the company’s incident response plan ahead of time, it becomes easier to address actual breaches when they occur. Baer Reed provides a variety of business and legal services, including assisting with internal investigations and helping organizations implement their incident response plans. To learn more, contact us today.