Breach Investigation and Notification

If you become aware of, or become suspicious of, a potential data breach, you must notify your organization's DPO.

There is a data breach incident reporting form attached at the end of this policy which must be completed giving as much detail as possible and submitted directly to the data protection officer.

your organization will investigate, contain, and respond to any such breaches without undue delay of receipt of the submission. It is the your organization's CISO's job to determine who will be responsible for further investigating the data breach.

The data breach containment strategies are designed to:

• Remove active attackers from your systems
• Prevent further attacks
• Contain the incident

Steps for containing the data breach

1. Isolate the threat - identify and remove active intruders and prevent further unauthorized access;
2. Reset passwords - force password resets for all the accounts on the domain or authentication system;
3. Implement Multi-Factor Authentication (MFA) - once you've isolated the threat and reset passwords, add MFA to any accounts;
4. Do not destroy evidence - you may need to determine where the breach started and devise a plan to prevent it from happening again. Also, depending on what type of data has been a breach, this can influence whether you need to notify the breach or not.

To assess the risk level, your organization will maintain a confidential breach register and measure the risk against certain criteria. In all cases where a breach has occurred, your organization will document it in the confidential breach register. The log of the breach will contain, but is not limited to:

• the origin of the breach (your organization or 3rd Party?) and the affected systems (list);
• the scope of the breach;
• the likely number of records affected by the data breach, especially ones which fall under the PHI, ePHI, or PII category and have special protection treatment;
• the likelihood of the breach impacting on the rights and freedoms of individuals;
• the business impact of the data breach: financial, reputation, operational downtime;
• any steps which have been taken to mitigate the impact of the breach;
• the sensitivity of the personal data subject to the breach.

After a data breach occurs, your organization will notify employees, customers, 3rd Parties, authorities, and/or media:

| Data Owners | Interval¹ | Breach Log | Notify ICO² | Template | Method | |-------------------|-----------|------------|--------------|-----------|-------------------| | Employees | < 24 hrs | Yes | Yes | No | Verbally and email| | Customers | 24-48 hrs | Yes | Yes | Yes | Email | | 3rd Parties | < 48 hrs | No | No | No | Email | | Media | > 72 hrs | No | No | Yes | Email | | Others | > 72 hrs | Yes | Yes | No | Email preferred |

• ¹Interval: since the breach has been discovered
• ²ICO: Information Commissioner's Office

Delays: if a law enforcement official states to a covered entity or business associate that a notification, notice, or posting required under this subpart would impede a criminal investigation or cause damage to national security, a covered entity or business associate shall:

• if the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting for the period specified by the official; or

• if the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described in paragraph (a) of this section is submitted during that time.