Incident commander must resolve whether executives must notify customers this

Situation

Incident commander in a hospital after a weekend EHR outage has one working extract — insider exfil of a customer export — after a backup job that has been silently failing for 19 days. If insider exfil of a customer export cannot support executives must notify customers, the honest Cybersecurity output is hold.

Decision

Incident commander in a hospital after a weekend EHR outage must choose Contain now / Monitor / Escalate / Hold using insider exfil of a customer export after a backup job that has been silently failing for 19 days.

Hypotheses to test

• Authorize Contain now now; insider exfil of a customer export already has the discriminator after a backup job that has been silently failing for 19 days.
• Keep Monitor in force until insider exfil of a customer export is completed after a backup job that has been silently failing for 19 days for incident commander.
• Treat insider exfil of a customer export as Escalate because both readings appear after a backup job that has been silently failing for 19 days.
• Refuse a Cybersecurity close: incident commander does not have the page executives must notify customers turns on in insider exfil of a customer export.

Analysis required

• Separate a scoped exception from an unbounded exposure a hospital after a weekend EHR outage has not measured.
• Map identities, standing privileges, and last-use timestamps in insider exfil of a customer export to the blast radius of a backup job that has been silently failing for 19 days.
• Name the compensating control that would let incident commander release a reversible hold.
• For this Cybersecurity Incident Response file, read insider exfil of a customer export against a backup job that has been silently failing for 19 days and write the one fact that would move executives must notify customers for incident commander.

Recommendation

Choose Contain now / Monitor / Escalate / Hold on this Cybersecurity / Incident Response packet (insider exfil of a customer export after a backup job that has been silently failing for 19 days). The follow-on Incident Response action is what incident commander does next: implement the option, assign an owner, and log the missing fact.