Legal counsel has confirmed that customers must be notified about a breach of their personal data. The security manager is reviewing the draft notification. What content is MOST important to include?
Select an answer to reveal the explanation.
Short Explanation
Put yourself in the customer's shoes: you'd want to know what happened and what you should do next. A good notice answers both in plain language. Spin, jargon and promises you can't keep are all traps that come back to bite.
Full Explanation
Customer notification serves two purposes: meeting legal obligations and enabling affected people to protect themselves. Effective notices explain in clear, plain language what happened and when, which types of data were involved, what the organization has done and is doing in response, what steps customers can take, such as monitoring accounts or changing credentials, and how to get further information or support. Counsel reviews the content against applicable requirements, which may specify particular elements. Detailed technical indicators of compromise are useful to security teams and partners but mean little to most customers, and they can distract from the actions customers need to take. Wording that minimizes the breach may mislead recipients, undermines trust when the full facts emerge and can create regulatory and legal exposure. A firm assurance that no harm will occur cannot be supported, because the organization cannot control how stolen data is used, and such promises may later be shown to be false. Exam caveat: notifications should be accurate based on known facts and avoid speculation; updates can follow as the investigation progresses. Operational check: confirm the draft has counsel's approval, addresses the required elements and provides a working support contact before it is sent.