Data Breach Triage And The Insurer’s First 72 Hours

For insurers, the question is no longer whether a data incident is possible. The more useful question is whether the organisation knows what it will do when personal information may already be at risk. This is the premise behind “data breach triage”.

The term borrows from emergency medicine. A hospital emergency unit cannot predict when it will be inundated by patients after a major accident. It can, however, prepare for the moment. It can decide how severity will be assessed, who must be called, which cases require immediate intervention and how decisions will be made under pressure.

Insurers require the same discipline in their response to data breaches, cyber incidents, supplier failures and employee-driven leaks. The aim is not to create the impression that every incident can be prevented. It is to ensure that, when an incident occurs, the business is not inventing its response while the risk is unfolding.