Incident Handling · Topic 3 of 4
Compliance Frameworks and Breach Reporting
Learn how GDPR, HIPAA, PCI DSS, FERPA and FISMA affect incident handling, and why reporting and notification requirements matter during a data breach.
- 5 min
- GDPR protects personal data of people in the European Union.
- HIPAA protects health information, and PCI DSS protects payment card data.
- FERPA covers student education records, and FISMA covers federal information systems.
What it is
Compliance frameworks are laws and standards that say how certain data must be protected and what to do when it is lost.
When a security incident involves regulated data, the technical response is only half the work. The organisation may also have to tell regulators, customers or other parties within a set time, and keep records to prove it.
This page covers five frameworks and the general ideas of reporting and notification.
How it works
Which rules apply depends on what data is involved, whose it is and where the organisation operates.
The five frameworks
| Framework | What it protects | Who it applies to |
|---|---|---|
| GDPR | Personal data of people in the European Union | Organisations handling that data, wherever they are based |
| HIPAA | Protected health information | Healthcare providers, health plans and their business partners in the United States |
| PCI DSS | Payment card data | Organisations that store, process or send card data |
| FERPA | Student education records | Schools and colleges in the United States that receive certain federal funding |
| FISMA | Information security of federal systems | United States federal agencies and the contractors that run systems for them |
GDPR, HIPAA, FERPA and FISMA are laws. PCI DSS is an industry standard set by the payment card brands and enforced through contracts with card processors.
The frameworks share common themes: know where the regulated data is, limit who can access it, protect it with controls such as encryption, keep logs, and have a plan for incidents.
Why compliance matters during an incident
Compliance changes how an incident is handled.
- Scope: the team must find out quickly whether regulated data was involved, because this decides which rules apply.
- Timing: some rules set a deadline for notification, so the clock may start when the organisation becomes aware of the breach.
- Evidence: logs, timelines and decisions must be kept, because regulators may ask for them.
- Communication: messages to the public and affected people should be reviewed by legal and compliance staff, not written on the fly.
- Penalties: failures can lead to fines, legal action and loss of trust, and, for PCI DSS, to extra costs set through the card contracts.
Reporting and notification requirements
A breach notification is a required message telling someone that protected data was exposed. Who is told, and when, depends on the framework. Two well known examples are:
| Framework | Notification rule in brief |
|---|---|
| GDPR | A personal data breach must be reported to the supervisory authority within 72 hours of becoming aware of it, where it is likely to put people at risk. Affected people must also be told when the risk to them is high |
| HIPAA | Affected individuals must be notified without unreasonable delay, and no later than 60 days after discovery |
PCI DSS expects an incident response plan, and the card brand and processor rules say who must be told. FERPA and FISMA have their own rules for institutions and federal agencies. Details vary, so the organisation's policy and legal team set the exact steps.
A good notification usually covers:
- what happened and when it was found
- what kinds of data were involved
- who may be affected
- what the organisation is doing about it
- what affected people can do to protect themselves
- a contact point for questions
For the exam, remember the idea that requirements exist and that the incident team must know who to inform and by when. You do not need to memorise the full text of every law.
Preparing in advance
Teams prepare before incidents by:
- keeping a list of the regulated data and where it is stored
- recording which rules apply to each system
- naming the people who decide on notifications
- including notification steps in the incident response plan
- practising with exercises, so that deadlines can be met under pressure
What to remember for the exam
Seven facts cover most questions on this topic.
- GDPR protects personal data of people in the European Union.
- HIPAA protects health information, and PCI DSS protects payment card data.
- FERPA covers student education records, and FISMA covers federal information systems.
- GDPR requires reporting a qualifying breach to the authority within 72 hours.
- HIPAA breach notices to individuals must go out within 60 days of discovery at the latest.
- PCI DSS is an industry standard, and the others named here are laws.
- Incident teams must find out quickly whether regulated data is involved.
Match the framework to the data. EU personal data is GDPR, health is HIPAA, cards are PCI DSS, students are FERPA, and federal systems are FISMA.
Common mistakes
These four errors are common.
Assuming only the home country matters. GDPR applies based on whose data it is, not just where the company sits.
Starting to count time late. The clock for notification often starts when the organisation becomes aware.
Sending public statements without review. Legal and compliance staff should approve them.
Not keeping records. Regulators may ask for logs and a timeline of decisions.
Compliance sets the minimum. A well protected organisation aims higher than the minimum.
Check yourself
Work through these three questions.
Which framework protects payment card data?
PCI DSS.
Within what time must a qualifying GDPR breach be reported to the authority?
Within 72 hours of becoming aware of it.
Why must an incident team find out early whether regulated data was involved?
It decides which rules and notification deadlines apply.
Topic 3 of 4 in Incident Handling
Test yourself on Incident Handling
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.