IR-8(1)
Incident Response
enhancement
Breaches
Parent: IR-8
Description
Include the following in the Incident Response Plan for breaches involving personally identifiable information: a. A process to determine if notice to individuals or other organizations, including oversight organizations, is needed; b. An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and c. Identification of applicable privacy requirements.
Mapped SPARTA techniques
No techniques mapped to this control.
Cite as SafeMode Space, nist-80053-rev5 IR-8(1).