SkarpChapter 1 of 3
Weigh conflicting incident evidence
Develop incident response and evidence while working to advise during incidents.
1. Separate observations from conclusions
Three lanes
Use separate lanes for observed facts, inferences, and legal conclusions. A fast report can be candid about uncertainty without presenting a hypothesis as a verified event.
Make the record auditable
For every material proposition, record its source, collection time, custodian, confidence level, and the evidence that could disprove it. This preserves the reasoning as facts evolve.
2. Test the evidence chain
Rapid evidence challenge
For each decisive artefact, ask:
- Identity: which account, person, workload, or service produced it?
- Meaning: does the event prove authentication, authorisation, listing, viewing, retrieval, disclosure, or only a request?
- Completeness: what telemetry gap, sampling rule, failed collector, or retention limit could make it misleading?
- Integrity: are timestamps normalised and is the original preserved?
Write one sentence beginning: "This proves X, but not Y."
That sentence is often more valuable than a longer forensic summary.
3. Weight sources by capability, not confidence
Capability beats confidence
A source should be weighted by what it can actually prove. Identity logs may establish token use; they do not, by themselves, establish document retrieval or disclosure.
Absence needs context
No network-transfer record is not automatically proof of no transfer. Test coverage, encrypted paths, provider-managed traffic, sampling, and any monitoring gap before relying on absence.
Preserve while containing
Preserve relevant evidence as early as practicable without unnecessarily delaying urgent containment. Before changing logging or rebuilding systems, preserve relevant originals where feasible; identify the authoritative clock and disclose drift.
4. Scenario: the disputed download
Conflicting facts
Meridian Ledger has evidence of a compromised token, document-index queries, and generated links. The provider reports no recorded “get object” retrieval event for the token, while network telemetry contains an 11-minute collection gap.
Two positions
Position A reserves judgment on retrieval. Position B records established unauthorised activity and access, while expressly reserving whether documents were retrieved or disclosed.
Best current advice
Choose Position B: it neither overclaims exfiltration nor understates access. Reverse it only on reliable evidence of authorised activity or proof that no personal data was reachable then.
5. Map each fact to the correct legal threshold
Access is a separate issue
Unauthorised access to personal data can itself fall within the G D P R breach definition. Keep access, retrieval, disclosure, likely consequences, and mitigation as separate factual propositions.
Use phased precision
Article 33 allows information to be supplied in phases when it cannot be provided together, while requiring a documented account of facts, effects, and remedial action.
6. Keep reporting regimes and contract evidence distinct
Progressive N I S two reporting
A N I S two report should distinguish an initial assessment from later findings. For an ongoing incident, Article 23(4) provides for a progress report and a later final report.
DORA: separate tests
DORA applies from January 17, 2025. Classify and report under its own framework; do not treat a personal-data conclusion as automatically determinative of a major I C T-related incident.
Article 30 is not classification
DORA Article 30(1), 30(2), and 30(3) concern different contractual requirements. A provider's contractual reporting duty may assist fact-finding, but it does not settle the legal threshold.
7. Draft the decision note
Five-line counsel note
Draft a live decision note using this sequence:
- Decision: what action is advised now.
- Established facts: only high-confidence propositions.
- Material uncertainty: what remains unresolved and why.
- Legal effect: the threshold being assessed under each applicable regime.
- Reversal trigger: the additional fact that would change the advice.
Avoid "no evidence of" unless you specify the system searched, period covered, and its coverage limits.
Reflection: Which additional fact could change your advice, and why?
Scenario quiz: choose the next decision
A compromised account queried a database containing customer identifiers. There is no confirmed export, and a network collector was offline for part of the event. What is the best next decision?
What is the best next decision?
- Record unauthorised access as established, preserve the uncertainty about retrieval or disclosure, and assess each applicable reporting threshold on that basis.
- Classify the event as an attempted intrusion only because no export has been proven.
- State that no personal data breach occurred because network telemetry did not record unusual egress.
Show Answer
Answer: A) Record unauthorised access as established, preserve the uncertainty about retrieval or disclosure, and assess each applicable reporting threshold on that basis.
The first option separates what the evidence establishes from what it does not. Under the G D P R, unauthorised access to personal data can constitute a personal data breach without proven exfiltration. The telemetry gap also prevents a categorical no-transfer conclusion. The decision could change if reliable evidence establishes that the account was authorised or that the database did not contain personal data at the relevant time.
Key Terms
- Inference
- A reasoned conclusion drawn from facts that remains dependent on assumptions and can be displaced by further evidence.
- Observed fact
- A proposition directly supported by a preserved artefact within the stated limits of that artefact.
- Reversal trigger
- A specified additional fact that would materially change the current legal advice or reporting position.
- Evidence coverage
- The systems, period, event types, and technical paths that a log source can reliably record.
- Unauthorised access
- Access to personal data without authorisation; it may be relevant to the G D P R personal-data-breach definition even where later retrieval is unproven. ([eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/EN-ES/TXT/?from=ES&uri=CELEX%3A32016R0679&utm_source=openai))