How should we answer a customer who asks whether we have had a security incident?
Truthfully, with facts and with what changed, within your legal and contractual limits. First agree internally what counts as an incident for this answer: a blocked phishing e-mail is not one, a compromised account usually is. Then answer with dates, scope, whether customer data was affected, which authorities were informed and what you improved afterwards. If an incident is still under investigation or covered by confidentiality, say what you can and when you will say more. A vague or evasive answer tends to cost more trust than a well-handled incident. Records make this easy: an incident register, the alerts behind it and the decisions taken. NetSenX keeps the alert history and the audit log of decisions for the retention period of your plan.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Is it better to disclose past security incidents to customers?
- What records do we need to answer questions about past incidents?
- What should the board know about the cost of IT downtime?
- What questions should the board ask the IT manager about security?
- What should cyber security training for the board cover?