[Reference: https://securityscorecard.com/blog/the-ultimate-data-breach-response-plan, To facilitate a robust data breach management response, an organization must have an inventory of affected individuals and systems, as this will help to identify the scope, impact and severity of the breach, and to take appropriate actions to contain, mitigate and notify the breach. An inventory of affected individuals and systems should include the following information:, The number and categories of data subjects whose personal data have been compromised, The types and volumes of personal data that have been exposed, altered or deleted, The sources and locations of the personal data, such as databases, servers, devices or third parties, The potential or actual consequences of the breach for the data subjects, such as identity theft, fraud, discrimination or physical harm, The systems and processes that have been compromised or affected by the breach, such as networks, applications, devices or security controls, The vulnerabilities or risks that have been exploited or introduced by the breach, such as malware, phishing, ransomware or human error, An inventory of affected individuals and systems will help the organization to assess the risk level of the breach, and to determine the appropriate response strategy and actions, such as:, Isolating or shutting down the affected systems or processes, Restoring or recovering the personal data from backups or other sources, Erasing or encrypting the personal data on the compromised devices or media, Analyzing the root cause and impact of the breach, Reporting the breach to the relevant authorities and stakeholders, Notifying the data subjects of their rights and remedies, Implementing corrective and preventive measures to avoid future breaches, References:, Data Breach Preparation and Response in Accordance With GDPR - ISACA, section 4: “The controller should document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.”, Cybersecurity Incident Response Exercise Guidance - ISACA, section 3: “The IRT should identify all assets involved in an incident (e.g., hardware, software) and determine what information was compromised (e.g., PII).”, Guide to Securing Personal Data in Electronic Medium, section 3.5: “Organisations should maintain an inventory of personal data in their possession or under their control.”, , , ]
