Outlines RMS’s procedures and responsibilities for identifying, containing and responding to a data breach.

Overview

This article outlines the procedures and protocols that RMS will follow in the event of a data breach involving the exposure of sensitive personal information to unauthorised parties. It defines the roles and responsibilities of key personnel and provides a comprehensive plan for breach identification, impact assessment, response, and future prevention.

What is a Data Breach?

A data breach refers to any incident involving unauthorised access to data owned by RMS or entrusted to RMS by its customers, vendors, or partners and hosted within RMS-operated data centres.

Such breaches can lead to the theft, loss, or unauthorised disclosure of personal or other sensitive information.

Common causes of data breaches include human error, malicious cyberattacks, and insufficient or improperly enforced access controls.

RMS's responsibilities and obligations in response to a data breach will vary depending on the nature, cause, and impact of the incident.

Response Team & Responsibilities

Data Breach Plan

In the event of a confirmed or suspected data breach, RMS response teams will follow the procedures outlined below.

These procedures are subject to periodic review and may be updated to reflect evolving best practices in cybersecurity, as well as changes in applicable legal or regulatory requirements.

Identify/Confirm Breach

1. A data breach can be caused by either internal or external entities.
2. Contact the person who reported the breach.
3. Identify how and when the breach was detected.
4. Establish if the breach is caused by an external or internal entity.
5. Establish if other teams are required to be notified and notify them if necessary.
6. Determine the User accounts, IP addresses of the hacker.
7. Determine when the first successful attempt was made.
8. Determine if any data was modified, such as additional User accounts created.
9. Establish the root cause of breach.
    

Document/Record Evidence of Breach

1. Document the following information as evidence using logs and any other tools available.
   1. User names that are used to access data.
   2. IP Address information.
   3. Timestamps of when unauthorized access was gained and / or data access / modification was made.
   4. If possible identify any modifications to data.
   5. Collect all other information deemed evidence
2. Copy/backup all logs for further analysis.

Measures to Stop Further Data Loss/Theft

1. Change passwords of identified user accounts used to gain unauthorized access.
2. Disable user accounts if required.
3. Restrict access based on IP address if possible.
4. Schedule any patches/updates if breach is due to a vulnerability in software.
5. Identify if security improvements are required by the software or architecture and implement if necessary.

Evaluate the Risk Associated/Extent of Data Breach

1. If the breach can cause further data loss/theft for other customers/vendors/partners or RMS then take similar measures as recorded earlier in "Measures to stop further data loss/theft" for all other entities/systems to ensure security.
2. If user accounts and IP address information has been identified then run scans on other systems to ensure no such connections were allowed.

Notification

The nature of breach determines who should be notified. 

If the breach directly affects customers then customers must be notified so proper prevention measures can also be taken by them. 

1. Notify customers through a phone call and follow up with a detailed email outlining all findings and measures taken to prevent any further damage.
2. Provide instructions to customers, if any action is required by them, to prevent further damage.
3. Notify law enforcement agencies if required.

Prevention

1. If the breach was due to an Operating System or third-party application, immediately update the software.
   1. If an update is not available contact vendor and inform them of incident and seek help to rectify.
   2. Evaluate current software update guidelines/schedules and make amendments as necessary.
2. If the breach was due to RMS software, immediately identify and contact Software Engineering team to fix the issue.
   1. Schedule downtime and update software as necessary.
   2. If the fix requires time then put temporary measures in place.
   3. Actively monitor all systems while a permanent solution is being developed.
3. If the breach is due to user error, social engineering attack etc. then educate the end users.
4. Harden security such as disable plain text protocols and only allow encrypted communication.
5. If security measures were already in place then re-evaluate infrastructure and identify/eliminate any weaknesses.
6. If any action is required from other customers to safeguard their data, create a detailed knowledge base article and send out communication to all customers.

Appendix A - Law Enforcement Authorities Contact Information