NIST CSF 2.0, RespondRS.AN-06

Document every personal data breach, its facts, its effects, and the corrective measures taken, so the Commissioner can verify compliance.

Keep an up-to-date inventory of personal-data breaches and the measures you took to remedy them.

Document every personal data breach, its facts, effects and remedial measures, so the Agency can verify your compliance.

Document every personal data breach, its facts, its effects and the remedial action taken, so the Commissioner can assess compliance.

Describe in the notification the nature of the breach, the data protection officer's or another contact point's details, the likely consequences and the measures taken or proposed, supplying the information in phases if it cannot all be given at once, and document every breach, its facts, effects and remedial action for the Agency to review.

Keep a register of personal data breaches that records the facts, their consequences and the action taken (Article 261д).

Document every personal data breach, with its facts, its effects and the remedial measures taken, so that the CNPD can verify your compliance (Article 27(5)).

Keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, and make it available to the Commission on request.

Document every breach that risks the security of personal data, noting its date, cause, related facts, effects and corrective measures, and keep that record available to the Agencia de Ciberseguridad del Estado.

Document every personal data breach, its facts, its effects and the remedial action taken, so the Authority can assess compliance.

Keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment, and keep the records of key processes, risks and risk treatment measures, and reported incidents and vulnerabilities for at least 5 years (point IS.D.OR.245).

Keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment, and keep the records of key processes, risks and risk treatment measures, and reported incidents and vulnerabilities for at least 5 years (point IS.I.OR.245).

Record all ICT-related incidents and significant cyber threats, and establish procedures and processes that ensure consistent and integrated monitoring, handling and follow-up of ICT-related incidents so that root causes are identified, documented and addressed (Article 17(2)).

Enter each cyber incident in the cyber incident log within 24 hours of detecting it, assess its significance at once, and report a significant incident to the competent cyber incident prevention institution on the early warning, initial report, progress report, intermediate report and final report forms within the clocks of Article 34 of the Law (points 47, 117 and 119).

Form a data classification team including your information security and information technology leads, and direct employees to report immediately any breach of this classification scheme, recording it with the corrective action taken.