SkarpChapter 2 of 3
Choose the next evidence-gathering step
Develop incident response and evidence while working to advise during incidents.
1. Start with the decision, not the evidence pile
Decision-changing unknown
Ask which disputed fact could change advice in the next hour, rather than collecting every available artefact.
Distinguish a genuine negative finding from a telemetry gap. "No evidence" may mean no visibility, not no access.
2. Preserve before you investigate
Perishability first
Prioritise short-retention sources: identity, cloud audit, endpoint, network, and database records. Preserve originals before remediation changes them.
An evidence register should capture provenance, time zone, method, integrity information, restrictions, and gaps. Work from copies.
3. Convert legal tests into factual questions
Map before collecting
For every issue, connect legal proposition → factual question → best source. The first source should be closest to the event.
Logs can evidence access; service owners can evidence operational criticality and losses. Neither source alone answers every question.
4. Test the G D P R fork: access, scope, and risk
G D P R evidence target
Evidence should support the breach nature, affected people and records, likely consequences, measures, and the separate internal breach record.
For disputed exposure, request a bounded object-access and data-scope query, plus the logging configuration that qualifies any negative result.
5. Quantify the DORA impact variables together
DORA impact is multi-variable
Collect clients, counterparts, transactions, reputation, downtime, spread, data losses, criticality, and economic impact together.
The sequence includes an intermediate report within 72 hours, an updated intermediate report following relevant changes or a request and, in any event, when regular activities recover, and a final report within one month after the intermediate or latest updated intermediate report.
6. Build the NIS Two final-report evidence trail
Two evidence tracks
Separate evidence of attack mechanism from evidence of impact and mitigation. An indicator of compromise is not itself a root-cause conclusion.
The final NIS Two account must address severity, impact, likely threat or root cause, mitigation, and applicable cross-border impact.
7. Apply the reversal test
Thought exercise: choose the fact that could reverse advice
Take the current proposed advice and complete these three lines:
- Current conclusion: What is the working legal and operational position?
- Reversal fact: What single additional fact would most plausibly reverse it?
- Fastest reliable source: Which source can establish or disprove that fact with the least delay and distortion?
Then assign an owner and a decision time. State what the team must preserve, what it may remediate immediately, and what remains uncertain.
This is not a demand for perfect knowledge. It is a disciplined way to make defensible advice explicit: the conclusion is based on identified evidence, bounded assumptions, and a named condition that would require reassessment.
Scenario quiz: Nordhaven Clearing
Choose the best next evidence-gathering decision
Nordhaven Clearing, a fictional EU financial entity, has restored a client portal after a four-hour outage. Engineers say an expired certificate caused the disruption. A cloud-security alert, however, shows that a privileged service token made 18 successful storage-list requests during the outage. The storage logs retain object names but not object-read events; the affected bucket contains encrypted client-statement archives. Operations has confirmed delayed transactions, but has not yet identified affected financial counterparts or countries.
Counsel must advise on the entity's G D P R and DORA posture. Two positions are defensible: this may be a certificate-only availability incident, or the service token may indicate unauthorised access with broader consequences. What is the best next step?
What should counsel direct first?
- Accept the certificate explanation, document that there is no proof of object reads, and focus evidence collection on restoring normal service metrics.
- Preserve and correlate the token's identity, credential-issuance, cloud-control-plane, network-egress, key-management, and archive-access evidence; in parallel obtain a reconciled impact extract for clients, financial counterparts, transactions, countries, downtime, and losses.
- Treat the 18 list requests as proof that all archive data was exfiltrated and instruct the team to finalise the incident's root cause and impact immediately.
Show Answer
Answer: B) Preserve and correlate the token's identity, credential-issuance, cloud-control-plane, network-egress, key-management, and archive-access evidence; in parallel obtain a reconciled impact extract for clients, financial counterparts, transactions, countries, downtime, and losses.
Option 2 is best because it tests the fact most likely to change the advice: whether the privileged token merely enumerated storage or accessed, decrypted, or transferred archive content. It also collects the DORA Article 18 impact variables that technical outage metrics alone omit, including affected financial counterparts, transactions, reputational impact, geography, and economic impact. Those figures support the initial notification; the intermediate report due no later than 72 hours after the initial notification, even if the incident has not changed; an updated intermediate report submitted without undue delay following relevant changes or a competent-authority request and, in any event, when regular activities have recovered; and the final report due no later than one month after the intermediate report or latest updated intermediate report. Option 1 mistakes incomplete read logging for a negative access finding. Option 3 overstates what list requests prove. The decision could reverse if preserved correlation evidence shows that the token was an authorised automated process, confined to metadata enumeration, with no decrypt, object-delivery, or egress activity; or if it instead demonstrates archive access or transfer.
Key Terms
- Reversal fact
- A fact which, if established, would materially change the current legal or operational advice.
- Evidence register
- A contemporaneous record of an artefact's source, collector, timing, preservation method, integrity details, restrictions, and known limitations.
- Personal-data breach
- A security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
- I C T-related incident
- Under DORA, an event compromising the security of network and information systems and having an adverse impact on data, systems, or services.
- Indicator of compromise
- Technical evidence suggesting that a system may have been breached or misused; it does not by itself establish root cause.
- Decision-to-evidence map
- A working table linking a legal or response decision to the factual question that matters and the most reliable source for answering it.