A step-by-step guide to assessing compromised data after a cyber incident

The most overlooked part of cyber incident response planning

Understanding the data that has been compromised in a cyber incident is generally the most critical, complex, costly, time-consuming and stressful part of any cyber incident response. And yet, compromised data assessment and notification is also the most overlooked part of cyber incident planning.

The methodology to be applied to this task and the tools and specialists the affected company may need to use are critical, yet often not considered. In this guide, we aim to address this gap and cover what to do before, and after, an incident.

This guide has been developed as a step-by-step process to help companies. It covers:

• the key challenges faced by companies in assessing compromised data
• practical takeaways from our recent experience advising on small and large-scale data reviews across multiple sectors
• 11 steps and decisions to be incorporated into any template data assessment and notification methodology.