P6.3

P6.3

The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity’s objectives related to privacy.

Category

Privacy

Subcategory

Privacy Criteria Related to Disclosure and Notification

Points of Focus

Creates and Retains Record of Detected or Reported Unauthorized Disclosures [P][C]

The entity creates and maintains a record of detected or reported unauthorized disclosures of personal information that is complete, accurate, and timely.

Evidence Requests

Area of Focus	Artifact	Description
Privacy	Accounting of Disclosures	Documented evidence of accounting for privacy-related disclosures.
Incident Response	Incident Response Program (IRP)	Documented evidence of a Incident Response Plan (IRP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.
Incident Response	Incident Reporting Capability	Documented evidence of a capability to provide situational awareness of incidents to internal stakeholders and generated necessary reporting to affected clients, applicable third-parties and regulatory authorities.
Incident Response	Sensitive / Regulated Data Spills	Documented evidence of records of response to sensitive / regulated data spills.