Data Breach Response Plan Template Australia

Standard Operating Procedure: Data Breach Response Plan (Australia)

Document ID: TR-SEC-IRP-001
Effective Date: 2023-10-27
Version: 1.0.0
Review Cadence: Annual or post-incident

---

1. Executive Summary & Purpose

This document provides the mandatory protocol for identifying, containing, and remediating data breaches involving personal information within an Australian context. The purpose is to ensure compliance with the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme, minimizing legal, financial, and reputational damage.

2. Scope & Prerequisites

• Scope: Applies to all systems, physical media, and third-party vendors handling Australian personal information under the control of Template Registry.
• Prerequisites:
  • Access to the Incident Response War Room (Secure Channel).
  • Pre-configured forensic logging tools (e.g., SIEM, EDR).
  • Up-to-date Data Asset Register.
  • Legal counsel retainer (Privacy-specialist firm).

3. Roles & Responsibilities (RACI Matrix)

---

4. Step-by-Step Procedure

Phase 1: Identification & Triage

• Log the initial detection timestamp and source.
• Assess if "Eligible Data Breach" criteria are met (likely to result in serious harm).
• Categorize the severity (Low, Medium, High, Critical).

Phase 2: Containment

• Isolate compromised systems (Network segmentation, revoke compromised credentials).
• Maintain evidence integrity (Snapshot disk images, export SIEM logs for forensic analysis).
• Disable compromised access points/APIs.

Phase 3: Assessment & Investigation

• Determine the scope of data accessed (Volume, sensitivity, data subjects).
• Evaluate the likelihood of "serious harm" per OAIC guidelines.
• Execute forensic deep-dive to determine the root cause (CVE exploitation, phishing, insider threat).

Phase 4: Notification (NDB Scheme Compliance)

• Notify the Office of the Australian Information Commissioner (OAIC) via the NDB Form if assessment confirms a breach.
• Prepare direct communications to impacted individuals (must include steps they can take).
• Coordinate with law enforcement if criminal activity is confirmed.

Phase 5: Post-Incident Recovery

• Patch identified vulnerabilities.
• Conduct a "Lessons Learned" session.
• Update the Data Asset Register and security documentation.

---

5. Quality Assurance & Pro-Tips

• Metric Thresholds:
  • Time-to-Containment (TTC): Target < 4 hours.
  • Time-to-Notify: Target < 30 days (Legislative requirement, but internal target is 72 hours).
• Pro-Tips:
  • Avoid Assumption: Never assume a breach is limited to the initial indicator of compromise (IOC). Always perform a lateral movement sweep.
  • Communication: All external communications must be vetted by Legal. Do not admit liability prematurely.
  • Documentation: Maintain an incident log separate from the main ticketing system to prevent unauthorized access.

---

6. Frequently Asked Questions (FAQ)

Q: At what point must I notify the OAIC?
A: You must notify the OAIC as soon as practicable if you have reasonable grounds to believe an "eligible data breach" has occurred. If you are uncertain, you have 30 days to conduct a reasonable and expeditious assessment.

Q: Does a "near miss" require a report?
A: No, but a "near miss" should be logged in your internal Incident Register to identify patterns and strengthen security posture.

Q: Can I use standard email for incident coordination?
A: No. If the incident involves email compromise or if the security of your mail server is in question, switch to an out-of-band, encrypted communication channel (e.g., Signal or hardware-encrypted enclave).

---

End of Document