Describe security operations, incident response reporting, and communication
Incident declaration and escalation, communicating with legal, regulators and executives, root cause analysis, and lessons learned.
- Reading time
- 20 min read
- Flashcards
- 17 cards
- Practice questions
- 8 questions · 2 PBQs
The last objective, and the one where a technically correct response can still become a disaster. During an incident, communication is not reporting on the work — it is part of the work.
Declaring and escalating
Incident declaration
The formal decision that an event is an incident. It activates the plan, the team and the communication tree. Declaring is a threshold defined in advance, not a judgement improvised at 2 a.m. by whoever is on shift.
Escalation
Raising the incident to a higher level of authority or expertise. Criteria are set in the plan: severity, scope, data types involved, duration, and whether the response needs decisions above the responder's authority.
The recurring exam point: escalate on defined criteria, not on how alarming it feels. A quiet incident touching regulated data escalates; a noisy one touching nothing may not.
Who gets told, and what they need
| Audience | What they need | The failure mode |
|---|---|---|
| Executives | Impact, scope, what is being done, what decision is needed | Technical detail they cannot act on |
| Legal counsel | The facts, early | Being told after statements are made |
| Regulators | Specific disclosures within a statutory deadline | Missing the clock |
| Affected customers | What happened, what data, what to do, what you are doing | Vagueness that erodes trust |
| Public relations | Approved messaging and a single spokesperson | Multiple uncoordinated statements |
| Law enforcement | Evidence, handled properly | Contaminated evidence, or contact without legal sign-off |
| Insurers | Prompt notification per the policy | Late notice voiding cover |
| Technical teams | Scope, indicators, actions required | Being told nothing and improvising |
Check yourself
During a suspected breach, a business unit manager wants to email affected customers immediately, before legal has assessed the situation. Why is this a problem?
Notification timelines
Regulatory clocks are real, short, and start earlier than people expect — usually from awareness, not from having finished investigating.
- GDPR — notify the supervisory authority within 72 hours of becoming aware, where there is risk to individuals' rights and freedoms; affected individuals "without undue delay" for high risk
- HIPAA — individual notification within 60 days for breaches of protected health information, with additional obligations by breach size
- PCI DSS — notify the card brands and acquirer promptly, per the payment brand rules
- Sector and jurisdiction rules vary and often stack — an incident can trigger several at once
The incident report
Written after the fact, and structured so different readers can each find what they need:
- Executive summary — what happened, impact, current status, in plain language
- Timeline — chronological, with timestamps, which is why clock synchronisation matters
- Scope and impact — systems, accounts, data, and the number of individuals affected
- Actions taken — detection, containment, eradication, recovery
- Root cause — the underlying condition, not the proximate trigger
- Recommendations — specific, owned, with dates
- Evidence and appendices — the technical detail, kept out of the narrative
Blameless post-incident review
A review focused on conditions and systems rather than individuals. Blame suppresses the candid reporting the review exists to produce, and it directs attention away from the fixable cause toward a person who will simply be more careful for a fortnight.
Metrics for security operations
- MTTD — mean time to detect. How long the adversary went unnoticed.
- MTTA — mean time to acknowledge. How long an alert sat before a human looked.
- MTTR — mean time to respond or recover, depending on the definition your organisation uses. Define which, and stay consistent — comparing across two definitions is meaningless.
- Dwell time — from initial compromise to detection. The single most telling number about a SOC's effectiveness.
- Alert volume and false-positive rate — whether tuning is working and whether analysts are drowning.
Check yourself
An organisation becomes aware on Monday that personal data was accessed in a breach. The investigation will take three weeks. Under GDPR, when must the supervisory authority be notified?
Communication during, not just after
Three habits that separate a controlled incident from a chaotic one:
- A single point of communication. One spokesperson externally, one coordinator internally. Multiple voices produce contradictory statements that then have to be corrected in public.
- Regular updates on a schedule, even when the update is that nothing has changed. Silence is filled with speculation.
- Out-of-band channels, agreed in advance, because the compromised environment may include the tools you would normally coordinate in.