Which of the following MUST be available to facilitate a robust data breach management response?

A robust data breach response is fundamentally dependent on quickly understanding the scope of the incident. This requires an up-to-date inventory of affected individuals and systems. Knowing which systems are compromised is essential for containment and eradication, while identifying affected individuals is critical for assessing the impact and fulfilling legal notification obligations. Without this information, a response would be uncoordinated and ineffective, failing to mitigate harm or meet regulatory requirements.

A. Lessons learned are for improving future responses, not a mandatory component for managing the current incident.
B. Data obfuscation is a preventative control to reduce the risk of a breach, not a component of the response itself.
C. An inventory of previously impacted individuals is irrelevant to a new breach affecting a potentially different group of people.

1. ISACA, CDPSE Review Manual, 2020, Chapter 3, Section: Data Breach Incident Response, "The incident response plan should include procedures for...identifying the scope of the breach, including the systems and data affected and the individuals whose data was compromised."

2. NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide, 2012, Section 3.2.4, p. 38, "Knowing which networks, systems, and applications are affected helps the team to determine the scope of the incident."

3. ISACA, Responding to a Targeted Cyberattack, 2016, Section: Containment, "The first step in containing an incident is to identify all affected systems."