Measured seriousness: scope, affected population, consequences, and service or data impact.

The relevant period must be defined: exposure, confirmed exploitation, non-compliance, and containment may differ.

Accurate, timely, usable assistance supported by delivery records; it is not an admission of liability.

A relevant historical finding or breach, documented by entity, conduct, outcome, and remediation status.

A determinable loss borne by another party, supported by claims, credits, invoices, or a stated method.

The seriousness of conduct and consequences, assessed through documented scope, impact, and affected parties.

A failure to meet the required standard of care assessed from the information, responsibilities, and decisions existing at the relevant time.

What is Mitigation file?

A structured evidential record organized around factors that may influence the type or amount of an administrative penalty.

What is Prior infringement?

A relevant earlier breach or final enforcement finding, distinguished from allegations and unrelated events.

Build the Mitigation File Before Penalties Are Set — Cyber Enforcement Counsel: From Regulatory Contact to Defensible Outcome

1. Open a mitigation file, not a mitigation narrative

Build for the decision

A penalty decision is not a second incident report. Build a controlled file that matches each statutory factor to a dated fact, source, owner, and measured conclusion.

Five working folders

Use folders for gravity and duration, intent or negligence, cooperation, prior infringements, and financial and third-party impact.

Do not call a fact mitigating just because it helps the company. Record the fact and evidence first. The authority decides its eventual weight.

2. Measure gravity and duration precisely

Use dimensions, not adjectives

For a cloud payroll platform, a tenant-isolation flaw existed for 19 days. Do not call it "limited" before separating exposure, actual access, duration, and containment.

Record the denominator: 46 tenants could reach the function, 7 did, and 183 invoices were accessed. Payroll processing remained available.

Separate vulnerable-code duration from confirmed-access duration. A 19-day deployment and a 6-hour access window are different penalty facts.

3. Test intent or negligence against the decision trail

Do not reason backwards

Intent and negligence concern what the company knew, decided, and failed to do at the relevant time. A bad outcome does not answer that question by itself.

Preserve risk acceptances, owner assignments, overdue notices, change approvals, and compensating-control evidence. These documents show the decision environment.

Use three columns: known at the time, decision taken, and evidence now available. Keep hindsight out of the first two.

4. Activity: turn cooperation into proof

A regulator asks for weekly updates after a ransomware disruption. The company sends polite letters but misses two promised dates.

Draft the evidence entries that would demonstrate useful cooperation:

A request-and-response log showing request date, scope, deadline, delivery date, and any correction.
A commitment tracker identifying the responsible executive, evidence needed, and revised date where delivery slips.
A disclosure index showing exactly which forensic results, customer-impact figures, and remediation validations were supplied.

Cooperation is not agreement with every allegation. It is accurate, timely, usable assistance in remedying the issue and mitigating adverse effects. Under GDPR, cooperation is a specific Article 83(2) factor; under DORA it is also relevant, without eliminating any necessary disgorgement of profits or avoided losses.

5. Separate prior history, financial strength, and third-party harm

Make history testable

Use a history schedule: entity, regulator, legal basis, date, conduct, outcome, remediation commitment, and closure proof. Separate allegations from final findings.

Use two separate schedules

Financial position covers turnover and provable benefit. Third-party effect covers refunds, restoration cost, credits, interruption, and verified losses.

Reconcile every amount to finance records, claims data, or a stated method. Do not turn unverified customer concern into a quantified loss.

6. Assemble the penalty-factor pack

The factor pack

Create a short package in which every folder contains the underlying documents, a source index, and a restrained factual conclusion.

For the payroll incident, support impact with logs and timestamps; cooperation with a production log; history with final-decision records; and losses with finance evidence.

Add a limitations note beside the affected analysis. EDPB Guidelines 04/2022 confirm that GDPR fining is case-specific, not automatic arithmetic.

Key distinctions

Flip the cards to test the distinctions that keep a mitigation file reliable.

Gravity: Measured seriousness: scope, affected population, consequences, and service or data impact.
Duration: The relevant period must be defined: exposure, confirmed exploitation, non-compliance, and containment may differ.
Cooperation: Accurate, timely, usable assistance supported by delivery records; it is not an admission of liability.
Prior infringement: A relevant historical finding or breach, documented by entity, conduct, outcome, and remediation status.
Third-party loss: A determinable loss borne by another party, supported by claims, credits, invoices, or a stated method.

Check the file before submission

Choose the strongest entry for the gravity-and-duration folder.

Which entry best supports a proportionate penalty assessment?

A timeline distinguishing vulnerable deployment, confirmed access, containment, affected population, and log-retention limits.
A statement that the incident was isolated, quickly resolved, and unlikely to recur.
A board presentation listing all security improvements planned for the next year.

Show Answer

Answer: A) A timeline distinguishing vulnerable deployment, confirmed access, containment, affected population, and log-retention limits.

The first option gives the authority measurable scope, duration, consequence, and evidential limitations. The other options may be relevant context, but they do not establish the statutory severity facts.

Key Terms

Gravity: The seriousness of conduct and consequences, assessed through documented scope, impact, and affected parties.
Negligence: A failure to meet the required standard of care assessed from the information, responsibilities, and decisions existing at the relevant time.
Mitigation file: A structured evidential record organized around factors that may influence the type or amount of an administrative penalty.
Prior infringement: A relevant earlier breach or final enforcement finding, distinguished from allegations and unrelated events.
Third-party impact: Verifiable financial, operational, or other adverse effects suffered by customers, data subjects, counterparties, or other parties.