Chapter 9 — Incident response and notification | Postgraduate Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Incident response and notification

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Process"]
  N2["9.2 Notification"]
  N3["9.3 Exercise"]
  N4["9.4 Learning"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Process"]
  N2["9.2 Notification"]
  N3["9.3 Exercise"]
  N4["9.4 Learning"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Process]
    |
    v
[9.2 Notification]
    |
    v
[9.3 Exercise]
    |
    v
[9.4 Learning]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) build an incident response process for a multi-site organisation; (2) meet notification obligations; (3) learn from incidents.

9.1 Process

Elena writes Moorfield's incident process. Any staff member can report through a single phone number or email address. The central team assesses severity using a short table. Serious incidents trigger an incident lead, a communications contact and notification to the operations director. The process covers containment, investigation, recovery and closure. She aligns it with the Respond and Recover functions of the NIST Cybersecurity Framework 2.0. Dr. Qureshi advises keeping the process short enough to use under pressure. The process fits on two pages with a severity table.

9.2 Notification

Health data breaches may require notification to regulators and patients within strict deadlines under data protection law, which varies by country. Elena works with Moorfield's data protection officer to define who decides whether notification is needed and how evidence is collected quickly. Cyber insurance also requires prompt notice. She adds a checklist so these obligations are considered early, rather than discovered after deadlines have passed. The data protection officer approves the checklist, and Elena prints it on the back of the incident process so both are always together. The insurer's notification number is added to the first page.

9.3 Exercise

Elena runs an exercise: a clinic receptionist reports that patients are receiving texts asking for payment to an unfamiliar account, apparently from Moorfield. Participants trace the cause to a compromised account at the text messaging supplier. They discover Moorfield's contract does not require the supplier to notify incidents promptly. Elena adds this to the supplier review. Dr. Qureshi notes that exercises often reveal supplier gaps, because suppliers are rarely included in planning. The operations director contacts the supplier the following week to agree new terms.

9.4 Learning

After each real incident, Elena holds a short blameless review: what happened, why controls did not stop it, what worked and what will change. She tracks actions to completion. Over a year, reviews lead to improvements in mail filtering, supplier contracts and locum account expiry. She learns that incidents are expensive lessons, and that recording and acting on them is how an organisation gets value from the cost. She keeps a log of reviews and actions, and the security committee checks progress on open actions at every monthly meeting.

Worked example

Elena writes a short multi-site incident process aligned with CSF 2.0 Respond and Recover, adds a notification checklist, runs a supplier-related exercise and holds blameless reviews.

Synthetic case. Incidents are synthetic; notification rules vary by country.

Errors and limits

Discovering notification deadlines late can turn an incident into a regulatory breach.

Exercises

EX041 — Report channel. How do staff report incidents? Rubric: 3 = a single phone number or email address;; 2 = partly correct;; 1 = vague;; 0 = none.
EX042 — CSF alignment. Which CSF 2.0 functions guide the process? Rubric: 3 = Respond and Recover;; 2 = partly correct;; 1 = other;; 0 = none.
EX043 — Notification partner. Who helps decide on notification? Rubric: 3 = the data protection officer;; 2 = partly correct;; 1 = other;; 0 = none.
EX044 — Exercise gap. What gap did the exercise reveal? Rubric: 3 = supplier not required to notify promptly;; 2 = partly correct;; 1 = vague;; 0 = none.
EX045 — Review outcome. Name one improvement from reviews. Rubric: 3 = locum account expiry;; 2 = one;; 1 = vague;; 0 = none.

Continue studying — lesson 09 (chapter 09 of 12)

← Chapter 08 · Course chapter index · Chapter 10 →

Continue to the next authored lesson.