The evidentiary connection between a control gap and an incident or between an infringement and claimed damage.

What is Burden of proof?

The obligation to demonstrate a proposition. In GDPR Article 82 damages litigation, Case C-340/21 places on the controller the burden of proving that its Article 32 measures were appropriate.

What is Security outcome?

What happened, such as unauthorised access, service disruption, or data loss. It is evidence for analysis, not itself a conclusion of legal failure.

What is State of the art?

The current maturity and availability of relevant technical and organisational measures, considered alongside context and implementation cost rather than treated as a requirement to adopt every new tool.

What is Risk-based appropriateness?

The requirement to select and operate security measures that fit the specific likelihood, severity, context, and consequences of the relevant risk, including measures for prevention and impact reduction.

Defend Reasonable Security Without Claiming Perfection — Cyber Enforcement Counsel: From Regulatory Contact to Defensible Outcome

1. Start with the legal question, not the bad outcome

Outcome is not breach

A cyber incident is important evidence. It is not automatically proof that the organisation's security measures were legally inadequate.

Two questions

Ask whether the incident exposed an inadequate control decision or whether a documented residual risk materialised despite proportionate safeguards.

GDPR Article 32 and NIS2 Article 21 require security appropriate to risk, including measures that prevent or minimise incident impact, not an absolute promise that incidents will never occur.

2. Reconstruct the pre-incident control decision

Use the pre-incident lens

Assess the safeguards using the information reasonably available when they were selected, not only the lessons revealed after the attack.

Example: session approval fraud

Multi-factor authentication can be strong against credential theft while still leaving exposure to a social-engineering path involving an enrolled device and a trusted help-desk process.

A risk record does not excuse a weak programme. It helps distinguish a reasoned control boundary from an omission that nobody assessed or owned.

3. Apply risk-based appropriateness and state of the art

State of the art is contextual

It is not a demand for every new tool. It asks whether reasonably available measures were considered in light of the organisation's actual risk.

Compare the threat and consequence with available controls, the controls actually selected, and evidence that those controls operated in practice.

Higher foreseeable impact raises the expected control standard. A sophisticated bypass does not itself prove that a layered framework for prevention, detection, response, containment, and recovery was inadequate.

4. Run the outcome-separation exercise

Sort the statements before drafting

A ransomware actor encrypts a hospital supplier's scheduling environment. Backups restore the service within six hours, but the attacker entered through a virtual private network account whose password had been reused after an exception to multi-factor authentication enrollment.

Classify each statement as outcome, control fact, or legal inference:

"The scheduling service was unavailable for six hours."
"The virtual private network account had an approved multi-factor authentication exception that had not been reviewed for nine months."
"The organisation therefore failed to implement appropriate cybersecurity measures."

Only the first is an outcome. The second is a control fact requiring context: why the exception existed, its compensating safeguards, review frequency, and whether the exception process complied with policy. The third is a legal inference. Do not let the severity of the outage silently convert the first statement into the third.

5. Identify when an incident points to control failure

A stronger failure pattern

A known material risk, an available mitigation, no supported alternative decision, and exploitation through that same path create a persuasive causal control narrative.

The key evidence is not simply that exploitation occurred. It is the connection between the known risk, the missing action, and the route the attacker used.

For the Cyber Resilience Act, Article 14 reporting duties have applied since September 11, 2026; the manufacturer risk-assessment obligations will apply from December 11, 2027.

6. Treat burden of proof as a file-building discipline

The controller must prove it

In GDPR damages litigation, the controller bears the burden of proving that its Article 32 measures were appropriate.

Build a demonstrable record: risk assumptions, design evidence, exceptions, test results, control operation, and reassessment when the risk changed.

Labels such as "industry standard" are not proof. The assessment must be concrete to the processing, system, and threat at issue.

7. Separate appropriateness from causation

Causation has two jobs

It links a possible control weakness to the incident path and, under GDPR Article 82, may affect responsibility for resulting damage.

A third-party attacker does not automatically eliminate responsibility. Equally, an attack does not automatically prove an inadequate security programme.

Use bounded conclusions that address prevention and impact reduction, state the evidence and plausible link, and identify what remains to be established.

8. Apply the test

Choose the most defensible conclusion

A company had documented encryption, network segmentation, tested restoration, and continuous vulnerability scanning. An attacker used a zero-day vulnerability before a vendor patch or reliable mitigation existed. The company contained the incident quickly. Which conclusion best reflects the legal analysis?

Which statement is most defensible?

The incident alone does not establish a legal control failure; assess the pre-incident risk, reasonably available measures, actual safeguards, control operation, and evidence concerning prevention and impact reduction.
Because the attacker gained access, the company necessarily failed to provide appropriate security.
Because the vulnerability was unknown, the company is automatically free of all regulatory and civil exposure.

Show Answer

Answer: A) The incident alone does not establish a legal control failure; assess the pre-incident risk, reasonably available measures, actual safeguards, control operation, and evidence concerning prevention and impact reduction.

An incident is not conclusive proof of inadequate security. The assessment must examine the overall risk-appropriate framework, including design, operation, detection, response, containment, recovery, and other contributing factors. A zero-day may support a managed-risk position, but it does not automatically resolve regulatory or civil exposure.

Key Terms

Causation: The evidentiary connection between a control gap and an incident or between an infringement and claimed damage.
Burden of proof: The obligation to demonstrate a proposition. In GDPR Article 82 damages litigation, Case C-340/21 places on the controller the burden of proving that its Article 32 measures were appropriate.
Security outcome: What happened, such as unauthorised access, service disruption, or data loss. It is evidence for analysis, not itself a conclusion of legal failure.
State of the art: The current maturity and availability of relevant technical and organisational measures, considered alongside context and implementation cost rather than treated as a requirement to adopt every new tool.
Risk-based appropriateness: The requirement to select and operate security measures that fit the specific likelihood, severity, context, and consequences of the relevant risk, including measures for prevention and impact reduction.