A data breach requires you, the general counsel, to quickly
assess the situation and be able to give a coherent initial report
to your CEO. If you are well organized you should be able to
prepare an effective CEO initial briefing in about 30 minutes. Here
are some tips from working with 52 data breaches /data compromises
in the past year. With advanced planning, every GC can master the
first steps of a computer intrusion smoothly. Try to follow these
nine steps in the order offered.
Step 1: The Debrief. This is the initial
debriefing from the IT director, the HR director or whoever
presents the information about the compromise. This may also be a
vendor, a bank or law enforcement. Get the bad news straight the
first time. This is a quick "who, what, where, when, why and
how" big conversation. Take no more than 10 minutes with this.
Try to define if this was a ping or an actual breach. Determine
whether the intrusion is still underway.
