Nine days after the ransom note appeared, the clinic's systems were running again and the attackers were locked out. The incident still wasn't over. About 18,400 patients had records in the stolen billing files, and they, a federal regulator, the FBI, the board, the insurer and the clinic's own staff all needed to hear about it, some on deadlines set by law. Then the clinic had to work out why the attack succeeded so it wouldn't happen again.
On the CompTIA Security+ SY0-801 exam, these final phases sit under objective 4.7, which expects you to explain each stage of incident response. This lesson covers notification and external reporting to stakeholders, customers, law enforcement and regulators, then the post-incident work: lessons learned, root cause analysis and the post-incident report.
Notification is planned in advance and run through counsel
Notification and external reporting means telling the people who need to know, accurately, through the right channel and on time. Like every phase, it overlaps the others. The clinic called its insurer within hours, because the policy required prompt notice, and contacted the FBI on the first day. Patient letters went out weeks later, once the investigation had established who was affected. The exam places notification after recovery because that is when its main work, the formal notices, usually happens.
Three rules keep notification under control. Legal counsel reviews every external statement, because each one can create legal exposure or contradict a later filing. One communications lead speaks for the organization, so regulators, the press and staff hear the same facts. And every message states what is known and what is being done, never guesses about the attacker or the data.
Stakeholders are everyone with a legitimate interest in the incident. At the clinic they included:
- The board and executives, who needed regular briefings and owned the major decisions.
- Staff, who needed instructions and an explanation, and who would be fielding questions from patients.
- The cyber insurer, whose policy required notice within a set period.
- Business partners and vendors, including the billing contractor whose account was used. Contracts often carry their own notice duties, separate from the law.
Mandatory reporting deadlines come from law and contract, and they vary
Some notifications are a choice; many are required. Mandatory reporting duties come from laws, regulations, industry rules and contracts, and which ones apply depends on the kind of data involved, where the affected people live, the organization's sector and whether it is publicly traded. Deadlines vary widely, and they are usually counted from when the organization discovers the breach or formally determines its significance, not when the investigation ends. Legal counsel decides which duties apply. The examples below are illustrations, not legal advice:
| Rule | Who it covers | Reporting duty, in summary |
|---|---|---|
| HIPAA Breach Notification Rule (U.S.) | Covered health-care providers, health plans and clearinghouses | Individuals without unreasonable delay, no later than 60 days after discovery; HHS; the media for large breaches |
| GDPR (EU) | Organizations handling personal data of people in the EU | Supervisory authority within 72 hours of becoming aware, where feasible; individuals when the risk to them is high |
| SEC disclosure rule (U.S.) | Publicly traded companies | Material incidents disclosed within four business days of determining they are material |
| U.S. state breach laws | Organizations holding state residents' personal information | Triggers, deadlines and regulators differ by state |
For the clinic, HIPAA set the pace. U.S. health regulators treat ransomware that encrypts patient data as a presumed breach unless the organization can show a low probability that the data was compromised, and here the data had also been copied out. The clinic mailed letters to affected patients on day 41, reported the breach to HHS, and, because more than 500 residents of its state were affected, notified prominent media outlets there. Some laws also allow law enforcement to request a delay in notification when notice would harm an investigation.
Laws and deadlines change, so for the exam, learn the pattern rather than every number: the type of data, the sector and the location of the affected people decide the rules, and missing a mandatory deadline adds fines and other penalties to the cost of the incident.