Ride the Lightning

Sedona Conference Issues Final Incident Response Plan

February 10, 2020

I've been meaning to cover this story for several weeks, but as my friend Doug Austin says, "So many stories, so little time." Hat tip to Doug who wrote about this before I did.

The 139-page Sedona Conference Incident Response Guide is available here.

The mission of Sedona Working Group 11 (WG11) is to identify and comment on trends in data security and privacy law to help organizations prepare for and respond to data breaches, and to assist attorneys and judicial officers in resolving questions of legal liability and damages. WG11 developed the Incident Response Guide to provide a comprehensive but practical guide to help practitioners and organizations deal with the multitude of legal, technical, and policy issues that arise whenever a data breach occurs.

The Incident Response Guide is intended to help organizations prepare and implement an incident response plan and, more generally, to understand the information that drives the development of such a plan. It has been created by thought leaders in the industry and reflects both the practical lessons learned and legal experience gained by the drafters from direct experience responding to incidents, from representation of affected clients, and from the promulgation of rules and guidelines on national and international levels, and is intended to provide general guidance on the topic.

Most solo and small law firms do not have an incident response plan. All 50 states, plus the District of Columbia, Guam, Puerto Rico and the Virgin Islands have enacted legislation requiring private or governmental entities to notify individuals of security breaches of information involving personally identifiable information. The specifics of the laws vary – but if you are subject to data breach notification laws, you'd darn well better have an Incident Response Plan if you want to avoid "headless chicken mode" in the middle of a crisis!

And for those who have a plan, make sure you update and train on the plan at least annually. Nothing having to do with cybersecurity or incident response planning stays static.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email: Phone: 703-359-0700 Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson