Legal counsel should review the specifics of your jurisdiction and ensure compliance with all reporting requirements.<\/li>\n<\/ul>\nThis is where you transform a painful, expensive experience into lasting organizational improvement. The post-incident review \u2014 sometimes called a „lessons learned“ or „retrospective“ \u2014 is arguably the most valuable phase of the entire response. This phase requires meticulous forensic analysis and careful coordination with legal counsel. The key is to act decisively but methodically \u2014 hasty containment can cause as much damage as the breach itself.<\/p>\n<\/p>\n
The following letter is a model for notifying people whose Social Security numbers have been stolen. Identity theft victims often can provide important information to law enforcement. See IdentityTheft.gov\/databreach for information on appropriate follow-up steps after a compromise, depending on the type of personal information that was exposed. People who are notified early can take steps to limit the damage.<\/p>\n<\/p>\n
Now comes the part most teams skip \u2013 and it\u2019s arguably the most important. Consider bringing in external incident response experts if you don\u2019t have this capability in-house. This is the step companies skip when they\u2019re in a rush to get back online. If criminal activity is involved, contact the FBI\u2019s IC3 or your local FBI field office. Tell them what happened and what they should do to protect themselves.<\/p>\n<\/p>\n
Phase 6: Post-Incident Review<\/h2>\n<\/p>\n