Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteContainment stops an attack from continuing; it does not explain what happened or settle what the organization must report. The next phase is to reconstruct the incident from evidence, determine which systems and people were affected, meet any applicable notification duties, and show that known security problems were acted on.
Why containment is only the start
An incident is not fully understood just because malicious access has been blocked or affected systems have been isolated. Organizations still need a reliable account of how the activity began, what it reached, what data may have been exposed or taken, and when each important event occurred. That account informs recovery decisions, legal assessments, communications, and answers to regulators.
As an Amazon Associate I earn from qualifying purchases.
The reconstruction should be evidence-led rather than built around the first plausible explanation. Logs, alerts, system records, incident-response notes, and other available evidence may describe different parts of the same event. A timeline that records what is known, when it became known, and what remains uncertain helps keep those pieces distinguishable.
How to build a defensible incident record
- Set the scope. Record which services, systems, accounts, and business operations were affected, and identify the evidence supporting each inclusion or exclusion.
- Build a dated timeline. Track the earliest known suspicious activity, alerts, investigation and containment actions, discovery of possible data exposure, and decisions made as the facts developed. Distinguish event time from the time the organization detected or learned of it.
- Assess data and people affected. Establish what categories of information were involved, whose information may have been affected, and what evidence supports the assessment. Mark unresolved points instead of presenting estimates as confirmed facts.
- Preserve the basis for decisions. Keep records of important findings, uncertainties, risk assessments, escalation decisions, and the reasons for notification or non-notification. This makes it possible to explain decisions in light of what was known at the time.
- Turn findings into assigned work. Record each identified weakness, its owner, the corrective action, and how completion will be checked. A security assessment that identifies a problem but does not lead to tracked action leaves an important question unanswered.
Which GDPR notifications may apply?
For organizations subject to the EU General Data Protection Regulation, Articles 33 and 34 set out separate duties for personal-data breaches. They do not create a single, unconditional 72-hour deadline for every incident. Whether the regulation applies, the organization’s role, the facts known, and the assessed risk all matter; this is not a substitute for advice on a particular incident.
| Who must act | Recipient | Trigger and timing under GDPR |
|---|---|---|
| Processor | The controller | Notify the controller without undue delay after becoming aware of a personal-data breach (Article 33(2)). |
| Controller | Competent supervisory authority | Notify without undue delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms (Article 33(1)). If notification is later than 72 hours, give reasons for the delay. |
| Controller | Affected individuals | Communicate without undue delay when the breach is likely to result in a high risk to individuals’ rights and freedoms (Article 34), subject to the regulation’s exceptions. |
The individual-communication threshold is not the same as the authority-notification threshold. Article 34 includes exceptions, including where specified protective measures made the affected personal data unintelligible to unauthorized people, or subsequent measures ensure that the high risk is no longer likely to materialize. The operative text is in Regulation (EU) 2016/679, Articles 33 and 34.
What regulatory scrutiny can reveal
Regulators may examine not only the breach itself but also how the organization responded to warnings and handled known weaknesses. The UK Information Commissioner’s Office (ICO) illustrated that scrutiny in its 15 October 2025 notice, “Capita fined £14m for data breach affecting over 6m people.” The ICO announced a combined £14 million fine—£8 million for Capita plc and £6 million for Capita Pension Solutions Limited—after a 2023 attack in which personal information relating to 6.6 million people was stolen.
Rank #2
Among the shortcomings the ICO identified were a slow response to a high-priority alert, a lack of subsequent penetration testing on certain systems, and penetration-test findings siloed within business units. The example shows why the incident record should connect warnings and assessment results to decisions, ownership, and follow-through. It does not establish that every breach or regulatory investigation will be judged on identical facts.
Where AI-enabled activity fits—and where it does not
AI-assisted attacks may complicate an investigation when activity is distributed across systems or resembles legitimate users or automated processes. The practical response is still to test competing explanations against available evidence and clearly separate confirmed events from inference. Brandy Wityak’s 21 August 2026 article in The AI Journal raises the challenge of reconstructing AI-driven attacks, but the claims available here do not independently establish that AI activity is always harder to attribute or that it changes GDPR’s notification thresholds.
Rank #3
The same caution applies to claims that regulators are adopting particular security frameworks as a universal enforcement rule. An organization should assess the law and regulator applicable to its circumstances, then document how its security decisions and incident response addressed the facts it actually faced.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
