A new regulation mandates that all data breaches involving personally identifiable information (PII) must be reported to affected individuals and regulatory authorities within 72 hours of discovery. An organization currently has an incident response plan that focuses primarily on containment and eradication, with reporting procedures being an afterthought. To comply with the new regulation, the organization needs to update its plan. Which of the following components of the incident response plan requires the MOST significant immediate revision?
- APost-incident Activity
- BPreparation
- CDetection and Analysis
- DContainment, Eradication, and Recovery
Show answer & explanationAnswer & explanation
Correct answer: A. Post-incident Activity
The new regulation specifically mandates rapid reporting to external parties. This activity falls squarely under 'Post-incident Activity' (or 'Communication'/'Reporting' within this phase) in most incident response frameworks, which includes lessons learned, evidence retention, and external reporting. While other phases are important, the immediate and most significant change driven by the 72-hour reporting requirement directly impacts the post-incident communication and reporting processes.
Why the other options are wrong
- B. Preparation involves setting up tools, training, and policies before an incident, but the core issue is reporting, not readiness.
- C. Detection and Analysis involves identifying and understanding the incident, which is a precursor to reporting, but the reporting itself is a later step.
- D. Containment, Eradication, and Recovery focuses on mitigating the technical impact of the incident itself, not the external communication requirements.
Incident Response Plan (IRP)
A documented set of procedures and guidelines that an organization follows to prepare for, detect, respond to, and recover from security incidents.
- Structured approach to incidents.
- Minimizes damage and recovery time.
- Includes preparation, detection, containment, eradication, recovery, and post-incident activities.
Memory trick: P-D-C-E-R-P: Prepare, Detect, Contain, Eradicate, Recover, Post-Incident.