5.3The impact of compliance frameworks

Incident response is not complete with technology alone, because the type of data you handle determines "whom you must notify, and by when, if it is breached," as set by law or industry rules. This section covers, at an introductory level, the correspondence of which data each major compliance framework governs—PCI-DSS (card data), HIPAA (health information), GDPR (EU personal data), FERPA (education records), and FISMA (US federal systems)—and how the reporting/notification requirements in a breach shape incident-response procedures.

5.3.1Major frameworks and the data they govern

• PCI-DSS is an industry standard (set by the card brands) that protects credit card holder data. HIPAA is the US rule protecting health information (protected health information). Because exams ask you to match by data type, nail "card = PCI-DSS / health = HIPAA."
• GDPR is the EU law protecting personal data, reaching even organizations outside the EU if they handle EU residents' data. FERPA is the US law protecting the privacy of students' education records. Remember "EU personal data = GDPR / education records = FERPA."
• FISMA is the US law that mandates security management for federal government information systems; it covers federal agencies and their related systems. "US federal systems = FISMA." These five govern different data and domains, so the knack is to choose by "what data" appears in the situation.

5.3.2How reporting/notification requirements affect incident response

• Many regulations set reporting/notification requirements for a breach. For example, GDPR requires notifying the supervisory authority within 72 hours as a rule of becoming aware of a personal-data breach. So an incident-response plan must build in "who notifies whom, by when" from the start.
• The recipient differs by regulation: the supervisory authority, the affected individuals, the card brands, a federal agency, and so on. Finishing technical containment but neglecting to report can itself become a violation and a penalty. So "technical response" and "legal reporting duty" proceed in parallel.
• The key at the introductory stage is being able to notice "this data brings this regulation into play, and a breach triggers a reporting duty." More than memorizing fine clauses, it is enough to make the judgment of linking the data type to the relevant framework and the need to notify.

Your company sells online to European customers and uses credit cards for payment. One day, unauthorized access to a web server raises suspicion that the names and addresses of EU-resident customers, along with card data, have leaked. A technician tends to think "closing the intrusion path and restoring the affected server completes the response," but that is a risky judgment missing the compliance view. First, look at the type of leaked data. If card data is involved, PCI-DSS applies; if EU residents' personal data is involved, GDPR applies at the same time. And under GDPR there is a duty to notify the supervisory authority within 72 hours as a rule of becoming aware of a personal-data breach, and depending on circumstances, to contact the affected individuals as well. So, in parallel with plugging the hole technically, you must work with legal and the responsible manager to move "who notifies whom, by when." If you finish only the technical containment, defer reporting, and let 72 hours pass, you now have a double problem—the breach plus a notification-duty violation—and possible penalties. The lesson: in incident response, first confirm "what data are we handling," and run the reporting/notification requirements tied to that data in parallel with the technical response. At the introductory stage you need not memorize clauses, but noticing "this data means this regulation, and there is a reporting duty" leads to a correct first response.

5.3.3Section summary

• Card = PCI-DSS / health = HIPAA / EU personal data = GDPR / education records = FERPA / US federal systems = FISMA—choose the regulation by data type
• Regulations set reporting/notification requirements for a breach (e.g., GDPR notifies the supervisory authority within 72 hours as a rule of awareness)
• Do not treat technical containment alone as complete—fulfilling the legal reporting duty in parallel is part of incident response