The breach
When something goes wrong
Wider than people assume. The commonest one in any employer is an email to the wrong person.
What Counts as a Breach
Wider than people assume. It is not only an attack, and most breaches in employment are somebody sending something to the wrong person.
The Seventy-Two Hours
The window is shorter than it sounds because it includes the weekend, and it starts before anybody is sure what happened.
Assessing Risk to People
The assessment that determines whether to notify, and the one organisations instinctively get backwards by assessing risk to themselves.
Telling the People Affected
The communication organisations most want to avoid, and the one that determines whether the incident becomes a lasting problem.
The Internal Report That Comes First
Nothing happens until somebody tells somebody. The reporting route is the control that everything else in this section depends on.
The Breach That Was Not One
Most reports turn out not to require notification. Handling those well is what keeps the reporting route open for the ones that do.