Assess Risk After a Breach – Including Security Breach Notification Laws By State

All 50 states have enacted legislation requiring private or governmental entities to notify individuals of security breaches of information involving personally identifiable information.

“Security breach laws typically have provisions regarding who must comply with the law (e.g., businesses, data/ information brokers, government entities, etc); definitions of “personal information” (e.g., name combined with SSN, drivers license or state ID, account numbers, etc.); what constitutes a breach (e.g., unauthorized acquisition of data); requirements for notice (e.g., timing or method of notice, who must be notified); and exemptions (e.g., for encrypted information).” according to the National Conference of State Legislatures.

A data breach occurs when there is an intentional or unintentional release of secure or private/confidential information to an untrusted environment. Data breaches can come in a plethora of forms, most commonly: ransomware, malware, phishing, denial of service & physical theft.

Once you have identified that there has been a breach determine the nature and extent of the data involved. Make sure to assess all different types of possible identifiers, sensitive information and extent of the data that was compromised. If possible you should also seek to determine the nature of the attack and the person who acquired, used or received the PII.

Take steps to mitigate the results of the breach and evaluate your risk across:
– Nature and extent of PI
– Unauthorized persons acquiring PI
– Risk whether PI was accessed or acquired
– Impact on risk of compromise mitigation steps

Security Breach Notification Laws

Resource by National Conference of State Legislatures: https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx