“It’s Been How Long!?” Best Practices for Communicating Notices Long Past a Cybersecurity Incident

For angered stakeholders who may not be fully cognizant of the standard timeline for an incident remediation and recovery, an understanding of the overall notification process may provide context around why notices could be sent months after an incident took place.

As a matter of process, once an incident is detected, a victim organization typically first engages third-party legal counsel, who in turn retain other external experts to assist in remediation and recovery. Only once these steps have been completed can data mining begin – an essential component in determining the size and scope of an incident and the data that may have been compromised. The data review process may vary incident-by-incident and typically remains ongoing without a firm or defined end date; the ambiguous nature of such an investigation can generate confusion among stakeholders who may not understand why further details are not available.

As the investigation continues beyond the initial incident response phase, legal counsel, external data mining firms and internal client teams must continue to coordinate data analysis efforts – a task which could involve sifting through terabytes of data to identify the information involved in the incident and to whom it belongs. Beyond this data review, there must also be an effort to synthesize and de-duplicate the information to determine the precise number of individuals with data affected in the incident; to determine if the information involved is considered protected health or personally identifiable information on a state-by-state basis; to procure a vendor for individual credit monitoring services, notice mailing and/or managing a call center, if applicable; to confirm addresses for letter recipients through the National Change of Address database; generating credit monitoring codes and preparing relevant instructions for those receiving notice letters; and, physically mailing notice letters, which sometimes must happen in multiple waves.

After all the above steps are completed, the victimized company is finally in a place where it is ready to notify affected individuals, mail notice letters, provide resources and – at last – seek closure after the incident. Yet, from this point on, stakeholder questions will likely accelerate, with inquiries such as why affected individuals hadn’t been notified earlier, and why the notification process took so long. Without vital context surrounding the investigation and data review process, stakeholders could become aggressive in questioning organizations that are trying to focus on recovery efforts and rebuilding trust.

All of these actions require a great deal of technical and communications expertise and logistical support – and will last several months.

In conclusion, a comprehensive communications plan is a critical building block in an organization’s incident response and recovery strategy. As cybersecurity incidents continue to proliferate around the globe, organizations ought to elevate their cybersecurity communications capabilities from within and proactively seek external expertise to help upskill in preparation for potential threats or to assist in response when crises hit.