ACCA Strategic Professional · Strategic Business Leader · IT systems security and control
Orion Logistics suffers a ransomware attack at 09:00 Monday. By Tuesday 15:00 it confirms that encrypted servers include unencrypted employee personal data that attackers may have copied. Under a GDPR-style regime requiring notification to the regulator within 72 hours of becoming aware, and to individuals where there is high risk, which action is most appropriate?
Orion should notify the regulator within 72 hours of becoming aware, providing information in phases if the investigation is incomplete, and inform employees if high risk is likely. Possible copying of unencrypted personal data creates risk, and attacker-applied encryption does not remove the duty to report.
- ANotify the regulator within 72 hours of becoming aware of the breach, even if investigation is incomplete, and inform employees if high risk is likelyCorrect
- BWait until the forensic investigation is complete before telling anyone
- CNotify only the employees, since the regulator is told after recovery
- DNotify no one, because the data was encrypted by the attackers
Explanation
The clock starts when the company becomes aware of a breach, and notification can be phased with incomplete information. Possible copying of unencrypted personal data implies likely high risk to individuals, so they should be informed too. Waiting for forensics or skipping the regulator breaches the rule; encryption by attackers gives no protection.
Did you get it right without looking?
One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.
More IT systems security and control questions
- Pelham Engineering and its overseas subsidiary exchange confidential design files by email. Management wants any recipient to verify both th…
- Marlow Bank has identified that a ransomware attack on its payment system has a high impact but a low likelihood, because of strong existing…
- Calder Logistics runs its order system from a single data centre. The board asks the IT director to document how the company would restore i…
- Harlow Retail needs its online store back within minutes of a failure and cannot lose any orders. Management is weighing a cold site, a warm…
- Kestrel Logistics runs its order system on a single server in its head office. A flood destroys the server room. Management has a documented…
- Orion Retail sends customer order files to a payment processor over the internet. Management wants assurance that only the processor can rea…