The Breach That Was Not One

Most internal reports do not meet the notification threshold. They are still worth handling properly, and most organisations handle them by filing them.

The breach workflow in “The Breach That Was Not One” is easier to operate when systems, owners and evidence are known in advance. If further details are available here supports fireable offenses, its records should sit inside the incident inventory with clear access, retention and escalation rules rather than being treated as an unexplained source of employee data.

What they usually turn out to be

A misdirected email recovered within minutes by a colleague who deleted it.

For a separate benchmark relevant to “The Breach That Was Not One”, consult the Cloudflare insider-threat overview. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.

A lost device that was encrypted and remotely wiped.

An access somebody had but should not have, used for nothing.

A near miss where nothing was actually disclosed.

Each is a report, none is necessarily notifiable, and each is telling you something.

Recording them anyway

The threshold reasoning goes in the record with the same care as a notification.

If a decision not to notify is ever examined, the only defence is a contemporaneous assessment. Written later it reads as reconstruction, which is what it would be.

Telling the reporter

The step that keeps the reporting route alive.

Somebody who reported a mistake and heard nothing concludes that reporting achieves nothing, and so does everybody they tell. A two-line message closing the loop costs nothing and is the difference between a route people use and one they do not.

The pattern is the finding

Three reports in a quarter from the same process is more informative than any one of them.

The same spreadsheet sent to the wrong distribution list, the same system allowing an export nobody needs, the same confusion about who should receive a document.

Non-notifiable reports are where the recurring defect is visible, and almost nobody looks at them as a set.

The quarterly read

All reports from the period, on one page, with what each turned out to be.

Half an hour. It produces the list of process fixes, and it tells you whether reporting volume is rising because things are going wrong or because people have started telling you — which are opposite findings and look identical in a single month.

What not to do

Treat a high report count as a problem.

An organisation with many reports and few notifications has a healthy reporting culture. One with no reports has either a remarkable operation or a workforce that has concluded there is no point.

Reading them as a set

All reports from the quarter on one page with what each turned out to be. Half an hour, and it produces the list of process fixes that individual reports never reveal.

Why volume is not a problem

An organisation with many reports and few notifications has a healthy reporting culture. One with no reports has either a remarkable operation or a workforce that concluded there was no point.

Three reports in a quarter from the same process is more informative than any one of them. Non-notifiable reports are where the recurring defect is visible and almost nobody reads them as a set.

Recording the ones that were nothing

The threshold reasoning, with the same care as a notification. If a decision not to notify is ever examined, a contemporaneous assessment is the only defence.

Closing the loop

A two-line message to whoever reported. It costs nothing and it is the difference between a route people use and one they conclude is pointless.