Tag
Incident Response
8 articles
Compliance frameworks
NIS2 incident reporting timelines
When an incident is significant under NIS2, what the early warning, notification and final report must contain, when each clock starts, and who else to tell.
6 min read
Security engineering
Running a tabletop exercise
A tabletop exercise is how most teams test an incident response plan. How to set objectives, write injects, run the session, and produce a report that counts.
6 min read
Security engineering
Writing an incident response plan
An incident response plan people can follow at 3 a.m.: what it must contain, setting severity and roles, tracking notification deadlines, and what to keep.
6 min read
Security engineering
Security monitoring and alerting
Logs prove nothing until someone looks. Which detections to build first, how to route and triage alerts, tune without losing coverage, and evidence it all.
6 min read
Audit readiness
What to do when a control fails mid-period
A control failed partway through your SOC 2 or ISO 27001 audit period. How to contain it, measure the extent, find the cause, and tell your auditor.
6 min read
Privacy
GDPR breach notification and the 72-hour clock
When the GDPR's 72-hour breach clock starts, what an Article 33 notice must contain, when to tell individuals, and how processors fit into the timeline.
7 min read
Compliance frameworks
HIPAA breach notification: timelines and thresholds
When an incident is a HIPAA breach, when the 60-day clock starts, who must be told at the 500-person thresholds, and what business associates owe customers.
6 min read
Compliance frameworks
DORA incident reporting
How DORA defines a major ICT-related incident, the classification criteria, the three reports owed to supervisors, and the runbook that meets each deadline.
6 min read