Reaction time: responding to a data security breach.

• Author: Werner, Randy R.
• Position: TechTalk

The external auditor was assigned to audit the financial statements of a multistate grocery store chain. During the audit, he uploaded payroll and pension plan data for about 5,000 employees onto his laptop, planning on encrypting the data when he got back to the office. He stopped for lunch at a restaurant, leaving his laptop in the car. When he returned, the doors were unlocked and the laptop was missing. What should the auditor do?

1. Report the loss immediately. Many victims err in not immediately reporting theft, either because they're embarrassed, worried about losing their job or thought they just misplaced the device. However, every firm should adopt a strict policy that requires employees to report losses immediately. This allows the firm to prevent further losses and begin the repair and retrieval process right away. Some state laws require that clients be notified within a short period of time following the detection of a data loss.

2. Activate safeguards for protecting personal information. A remote mobile device security service is an effective way to provide safeguards capable of activating a "kill switch" if security has been compromised. Remote security enables a user to prevent access to protected files, or to execute complete data wiping in the event a device has been lost or stolen. The service also may track devices when they're connected to the internet.

   Other protective actions, such as maintaining encryption policies, should protect the organization independently of the end-user and should be effective whether the computer is online or offline. Some online subscription services are available without the need to purchase or support hardware or software infrastructure.

3. Notify the firm's attorney or risk adviser/insurance company. They'll assist the firm in determining whether there has been a breach as defined by state or federal laws. The advisers also should be able to help fulfill legal reporting and notification requirements.

   Cyberliability is recommended for covering data breach response costs, including notifications to clients and third parties, as well as computer network assets, such as data. Some insurance policies cover legal services, forensic services and business interruption expense, as well expense stemming from cyberextortion and cyberterrorism.

   Some states require that law enforcement be notified of data theft, which may trigger news media attention that could affect the firm's public image and...