legal Controls

Vendor contracts include minimum cybersecurity requirements

Legal, regulatory, and contractual requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed

Public updates on the incident and ongoing recovery are shared using approved methods and messaging

Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

Escalate or elevate incidents as needed