Menu
Kelcey Patrick-Ferree Law Iowa Minnesota header logo
Midwest Business Law Firm Serving Iowa & Minnesota
  • About
    • Who is Kelcey Patrick-Ferree?
    • Who is David Ferree?
  • Areas of Practice
    • Business Law
    • Intellectual Property
    • Contracts & Licensing
    • eCommerce
    • Privacy & Data Security
  • Blog
  • Resources
Close Menu

Contact Us Today

You have detected a data breach. Alert!

You Detected a Data Breach. Now What?

Kelcey Patrick-Ferree Business Law, Compliance, Privacy and Data Security 201 CMR 1700, business, Compliance, Data breach, data security, Internet, Privacy, WISP, written information security plan

You are the CEO of a mid-size company. As you are going about your day, minding your business, you get a call from your security department. It’s a call you really didn’t want. Security has detected suspicious file movements and wants your directions about what to do next. You have likely suffered a data breach.

Now what?

Ideally, you will go to your shelf and pull out your executive copy of the company’s data breach plan. But what if you don’t have a plan?

As with most policies, the time to develop your data breach plan is “before you need it.” In this case, it’s important for two main reasons. First, the law requires you to have a plan if you have Massachusetts customers (as part of a Written Information Security Plan, or WISP) or are in one of any number of regulated industries. Second, odds are high that your business will suffer a data breach sooner or later.

If you don’t have a plan yet, you are not alone. About 20% of companies have not yet developed a plan, according to a 2015 Ponemon study. If you do have a plan but aren’t totally confident in it, again, you are not alone. About 2/3 of companies with a plan weren’t confident in their plans in the same study. If you don’t have a plan, or if you do have a plan and wonder whether it covers everything it should, this post is for you.

Your company’s data breach plan should include each of these important elements:

    The Right Crowd. When you develop your plan, you should include at minimum your security, technology, legal, customer service, and PR/communications folks, as well as representatives from any areas specifically affected. For example, include someone from HR when developing policies about handling HR data. Depending on the size of your organization, this group might include anywhere from 2 people to 20. In final form, your plan should include the roles and responsibilities of people from all of these groups as well. If you don’t have the right people in the room from the start, you face the very real possibility of chaos when a data breach occurs.

    Administrative, Technical, and Physical Safeguards. Your plan should cover how you are going to keep your data as safe as possible. You may not be able to prevent every breach, but you can reduce the number and severity of breaches by taking some basic cybersecurity steps. Administrative safeguards have to do with people’s behaviors and knowledge. Examples include policies about access to and use of data, hardware, and software; background checks; agreements; and training. Technical safeguards have to do with preventing access electronically. Examples include encryption, separating identifier and content data, roles-based systems access, and regular logging and auditing of access to systems. Physical safeguards have to do with preventing physical access to sensitive information. Examples include locked filing cabinets, secure workstations, video surveillance, biometric locks, and ID badges.

    Business Continuity. Your plan should tell you how to keep your business running if you do not have access to your computers or files. This may or may not be included in your normal business continuity plan, so be sure to check. A natural disaster that takes out one of your two locations will play out very differently from a ransomeware attack that ties up your entire network.

    Specific Steps. A data breach plan should ideally cover exactly who does what, and when. In the heat of the moment, your employees may not be thinking clearly; your plan should guide them so that they avoid panicked mistakes. In creating the plan, your organization should spend some time figuring out what its greatest vulnerabilities are and how it will address a resulting breach should it occur. (Ideally, of course, you will find ways to reduce these vulnerabilities during the course of developing your plan, but we live in the real world where time and budget are always constraints.) A data breach plan should cover these specific steps:

    • Escalation: When do you contact your internal and external security team and lawyers? When do you contact your Chief Information Officer? CEO? Your board? If there is any indication of a major incident, your first call should be to your data forensics consultant; the consultant will help you avoid accidentally harming your own systems or destroying any evidence. Beyond that, your next calls will depend a great deal on your organizational structure and preferences.
    • Investigation. If your business can afford it, you should enlist outside help with a data breach; legal, PR, and data forensics consultants will have experience that you may not have internally. They will also be able to give you perspective in a stressful situation. It is important to know who you will contact for outside help ahead of time. Be sure to keep their contact information in your breach plan. During the course of investigation, no matter who is conducting it, it is most important that you avoid destroying evidence, notify law enforcement, and ask the right questions: What specifically was compromised? What can we do to prevent further damage? Can this system be quarantined? What data can be salvaged? What data can we still trust? Can we trace who did it? And perhaps most importantly, is it a data breach as defined by law?
    • Most laws and regulations define “data breach” slightly differently from one another. Generally, though, a data breach is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a data collector.

    • Responses/Reporting. If you determine that your incident is a data breach under applicable law, you will need to report the breach. The law or regulation that applies to your situation will tell you who you need to contact. Most of the time, you will need to tell law enforcement and the people whose information was affected by the breach. You may also need to tell investors, state attorneys general, regulators, credit reporting agencies, or the media. In order to expedite reporting, you should consider having template versions of communications to these parties in your data breach plan.
    • Remediation. First, protect your customers from further damage. Make sure that any information that has been placed on the web is removed, including information on cached sites. Second, make sure that your company is protected for the future. Ideally, the same kind of incident should never happen to the same company twice. After the excitement has died down, evaluate what happened. Follow any steps recommended by your data forensics consultant. Consider whether you need to revamp any contractor relationships, contracts, technology, training programs, or physical safeguards.
    • Re-Evaluation and Practice. Take a look at your breach plan. How well did it perform? Would you do something differently next time? If so, amend the plan. If the plan worked well, practice it. You should run internal and external drills regularly, so use this opportunity for another run-through.

And now? If you already have a plan, great! You should make sure it contains all of these elements, then practice it this week. If you do not have a plan, don’t panic! Gather the folks in your company who need to be involved and develop one. This week.

Does your company have a plan? Do you trust that it will work if you need to implement it tomorrow?

Agricultural Leases, or A Horse is a Horse Upcoming Event: Local Government Law CLE

Related Posts

Contracts & Licensing

Business Law, Contracts and Licensing

Contracts in Disasters and Emergencies

Working from home woman business owner typing and texting.

Business Law

Ideas for Businesses and Business Owners Unexpectedly Working From Home Part II

Working from home woman business owner typing and texting.

Business Law, Compliance, Contracts and Licensing, Intellectual Property

Ideas for Businesses and Business Owners Unexpectedly Working From Home Part I

Recent Posts

  • Contracts in Disasters and Emergencies
  • Ideas for Businesses and Business Owners Unexpectedly Working From Home Part II
  • Ideas for Businesses and Business Owners Unexpectedly Working From Home Part I
  • COVID-19 Coronavirus and Resources for Your Business
  • Updating Your Website? Update Your Terms!

Categories

  • Business Law
  • Compliance
  • Contracts and Licensing
  • Government
  • Intellectual Property
  • Internet
  • Privacy and Data Security
  • Real Estate and Land Leasing
  • Social Media
  • Uncategorized

Tags

Advertising CAN-SPAM Compliance Contracts Contracts and Licensing Copyright Copyright Act Copyright Infringement Copyright Office Coronavirus COVID-19 Creative Commons Crowdfunding Distinctiveness Emerging Growth Company Eminent domain Fair Use Funding Platform How Do I Protect My Idea? Intellectual Property Internet Internet Law Iowa Iowa Supreme Court JOBS Act Legal Terms in Real Life Licensing New Terms of Use Nondisclosure Agreement Patent Pinterest Pinterest Fair Use Pinterest Terms of Service Pinterest Terms of Use privacy policy Service Mark Small Business Social Media Supreme Court Terms of Service Terms of Use Trademark Trade Secret Types of IP Web Sharing

How Can We Help?

Contracts & Licensing

Contracts in Disasters and Emergencies

Recent Posts

To schedule your initial free consultation,
fill out this form:

Contact Us
Checkboxes *
Kelcey Patrick-Ferree Law header logo
  • About
    • Who is Kelcey Patrick-Ferree?
    • Who is David Ferree?
  • Areas of Practice
    • Business Law
    • Intellectual Property
    • Contracts & Licensing
    • eCommerce
    • Privacy & Data Security
  • Blog
  • Resources

Minnesota: 612.568.5573

Iowa: 319.383.0659

136 South Dubuque St, Iowa City, IA 52240

By Appointment Only

© 2021 Patrick-Ferree Law, P.L.L.C. | Website Development by Vortex Digital Business Solutions © – All Rights Reserved | Contact Webmaster
Terms of Use and Privacy Policy

Disclaimer

The information provided on this website, including the blog, is not intended to be and should not be relied upon as legal advice. Using this website or contacting Patrick-Ferree Law, P.L.L.C. through this website does not create an attorney-client relationship. As a general rule, you should not provide any confidential information to any attorney until an attorney-client relationship has been established in writing. Please feel free to contact Patrick-Ferree Law, P.L.L.C. for an initial consultation, but be aware that this does not form an attorney-client relationship. The determination of the need for legal services and the choice of a lawyer are extremely important decisions and should not be based solely upon advertisements or self-proclaimed expertise. A description or indication of practice does not mean that any agency or board has certified such lawyer is necessarily any more expert or competent than any other lawyer. All potential clients are urged to make their own independent investigation and evaluation of any lawyer being considered. Attorney advertising.