What are the FTC Recommendations in their 2016 Data Breach Response Guide For Business?
Secure Your Operations
Act swiftly to secure your systems and address vulnerabilities that led to the breach. Preventing further breaches is crucial. Immediately mobilize a breach response team tailored to your company's needs, which may include experts in forensics, legal affairs, information security, IT, operations, HR, communications, investor relations, and management.
-
Forensic Investigation: Engage forensic investigators to identify the breach's origin and scope, capturing evidence and recommending remedial actions.
-
Legal Counsel: Consult with legal experts, potentially hiring external counsel with privacy and data security expertise to navigate applicable federal and state laws.
-
Physical Security: Secure areas related to the breach, change access codes if necessary, and follow law enforcement advice on when to resume operations.
-
Data Protection: Immediately take affected equipment offline to halt further data loss. Update credentials and passwords to prevent continued vulnerability.
-
Website Cleanup: Remove any improperly posted personal information from your website and contact search engines to prevent caching of sensitive data. Check other websites for copies of exposed data and request removal.
-
Investigation Documentation: Interview individuals aware of the breach, including customer service staff, and document all findings without destroying forensic evidence.
Fix Vulnerabilities
After addressing immediate security measures, focus on fixing vulnerabilities to prevent future breaches.
-
Service Providers: Begin by assessing your service providers' access to personal information and adjust their privileges as needed. Ensure your providers are actively securing their systems against potential breaches, verifying their claims of remediation.
-
Network Segmentation: Review your network segmentation strategy to evaluate its effectiveness in containing breaches. Collaborate with forensic experts to analyze breaches and make necessary adjustments to your segmentation plan.
-
Forensics Experts: Work closely with forensics teams to determine if encryption was in place during the breach and review stored data backups. Audit access logs to identify who accessed data during the breach and assess current access permissions. Restrict unnecessary access promptly and gather comprehensive details such as the compromised information types and affected individuals' contact information from forensic reports.
-
Communications Plan: Develop a communication strategy that transparently informs all affected parties, including employees, customers, investors, and partners. Avoid misleading statements or omissions that could jeopardize consumer protection. Prepare clear, accessible answers to anticipated questions on your website to alleviate customer concerns and streamline communication during this critical period. Effective communication now can minimize customer frustration and protect your company's reputation in the long run.
Notify Appropriate Parties
In the event of a data breach, it's crucial to promptly notify relevant parties: law enforcement, affected businesses, and individuals whose information may have been compromised.
-
Determine Legal Requirements: First, understand your legal obligations under state, federal, and industry-specific regulations regarding data breach notifications. Most states and territories mandate notifying individuals if personal information is compromised, and specific rules may apply depending on the nature of the data involved.
-
Notify Law Enforcement: Contact local law enforcement immediately to report the breach and potential risks of identity theft. If needed, engage agencies like the FBI or U.S. Secret Service for further assistance, especially for incidents involving mail theft or electronic health information covered under specific regulations like HIPAA.
-
Notify Affected Businesses: If the breach involves sensitive account information (e.g., credit card details), inform the relevant financial institutions to monitor for fraudulent activities. Additionally, notify businesses for whom you handle personal data, ensuring they are aware of the breach.
-
Notify Individuals: Notify affected individuals promptly, considering state laws and the nature of compromised information. Provide clear details about the breach, including how it occurred, what information was affected, actions taken to mitigate risks, and contact information for inquiries. Offer support such as free credit monitoring or identity theft protection if sensitive data like Social Security numbers were exposed.
These materials were obtained directly from the Federal Government public website and are posted here for your review and reference only. No Claim to Original U.S. Government Works. This may not be the most recent version. The U.S. Government may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.