What should you do first to ascertain additional information about the loss of data?

SCENARIO

Please use the following to answer the next QUESTION:

It’s just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It’s a great deal, and after a month, more than half the organization’s employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It’s enough to give you data- protection nightmares, and you’ve pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.

Today you have in your office a representative of the organization’s marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.

You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.

What should you do first to ascertain additional information about the loss of data?
A . Interview the person reporting the incident following a standard protocol.
B . Call the police to investigate even if you are unsure a crime occurred.
C . Investigate the background of the person reporting the incident.
D . Check company records of the latest backups to see what data may be recoverable.

View Answer

Answer: A

Explanation:

This answer is the best way to ascertain additional information about the loss of data, as it allows you to gather relevant facts and details from the person who witnessed or experienced the incident.

A standard protocol for interviewing the person reporting the incident should include questions such as:

When and where did the incident occur?

What type and amount of data was involved?

How was the data stored or protected on the laptop?

Who else had access to or knowledge of the laptop or the data?

What actions have been taken so far to recover or secure the laptop or the data?

How did you discover or report the incident?

Do you have any evidence or clues about who may have taken or accessed the laptop or the data? Do you have any other information that may be relevant or helpful for the investigation? Interviewing the person reporting the incident following a standard protocol can help you to establish a clear timeline and scope of the incident, identify potential sources of evidence, assess the level of risk and harm to the individuals and the organization, and determine the next steps for responding to and resolving the incident.

Reference: IAPP CIPM Study Guide, page 87; ISO/IEC 27002:2013, section 16.1.4