Detection, Incident Response and Notification

Lesson 10 ended with people: policies, training, reporting habits. This lesson picks up at the moment something goes wrong and the habits get tested. It covers how a mid-sized business sees an attack, how it decides what to do, and which outside clocks start running. For the how-to side at the scale of an office of 1 to 50, with a one-page incident card, see the small business data security module. For the laws behind the clocks, see lesson 06 and lesson 07. For the general public's view of the same laws, see the privacy and data security laws module.

Start with how long attackers usually stay unseen. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, up 12 percent from the year before, as of October 2026 (IBM). A law-firm summary of the same report puts the average time to identify and contain a breach at 247 days, and says breaches contained inside 200 days averaged $4.32 million against $5.65 million for those that ran longer (Baker Donelson summary; the full IBM report sits behind a registration form, so these figures are as the law firm reports them). The gap between $4.32 million and $5.65 million is $1.33 million. That is what the extra weeks cost. Detection is the part of security that shortens the clock.

Logging, EDR, MDR and who watches

Vendor pitches blur these terms. They are layers, not synonyms.

Term	Plain meaning	Who reads the output	Rough price signal (unsourced, get quotes)	What it does not do
Logs	Time-stamped records from systems: sign-ins, admin changes, file access, firewall events	Nobody, unless a tool or person reads them	Often included in your cloud and software licenses; storing them longer costs extra	Raise an alarm by themselves
SIEM	A system that pulls logs together and runs rules over them	An analyst, or an MDR provider	Priced by data volume; usually bundled into a managed service for firms under 500	Decide what is real without a person tuning it
EDR (endpoint detection and response)	Agent software on laptops and servers that records behavior and can isolate a machine	Your IT team or an MDR provider	Commonly quoted per device per month; rough range from single digits to the low teens of dollars per device	Cover devices without the agent, such as printers, some cameras, unmanaged personal phones
MDR (managed detection and response)	An outside team watching EDR and other signals around the clock, investigating and acting or calling you	The provider's analysts, with your named contacts	Commonly quoted per device or per user per month on top of or including EDR	Replace your decision rights: someone at your firm still must approve shutting down an order system

The prices above are a rough signal only. Vendor price lists vary by region, contract length and what is bundled. Use them to sanity-check a quote, not to budget. Whatever the price, ask the same question of every proposal: when an alert is real at 2 a.m. on a Sunday, who is paged, what are they allowed to do without calling us, and where is that written down?

The three coverage questions

First, what is collected. At minimum, sign-in logs and admin actions from your identity system and email, endpoint telemetry from EDR, and firewall or VPN logs. Second, how long it is kept. Investigators often need to look back months, because the attacker was inside before anyone noticed. Ninety days online and a year archived is a common target, and some rules set their own periods, so check yours. Third, who is allowed to change or delete logs. Administrators of the very systems being logged should not be the only people who can erase the record.

The NIST Cybersecurity Framework 2.0 names two Detect categories that fit this: Continuous Monitoring (DE.CM, watching assets for anomalies and signs of compromise) and Adverse Event Analysis (DE.AE, deciding whether an event is an incident) (NIST CSWP 29). Those two labels are a handy way to separate "we collect data" from "somebody decides what it means."

Decision table: who watches

Situation	Reasonable choice	Why	Evidence to keep
Under 50 staff, mostly cloud services, no IT staff	EDR plus MDR from your IT provider or a security vendor, with email and identity alerts included	You cannot staff nights. A provider can.	Contract, alert-handling procedure, monthly report
50 to 250 staff, small IT team	EDR in-house for business hours, MDR or after-hours monitoring contract for nights and weekends	Splits cost and keeps local knowledge	On-call roster, escalation timing, test of the page-out
250 to 500 staff, security lead on payroll	MDR or an in-house analyst team with a SIEM; outside provider for surge capacity	Volume justifies tooling; surge help still needed in a major event	Alert metrics, tuning log, retainer for incident help
Regulated (HIPAA, GLBA, PCI, defense contracts)	Same choices, with log retention and review frequency set by the rule or contract	Auditors will ask for proof of review, not only collection	Dated review sign-offs, retention settings screenshot

The incident response plan

Several rules require a written plan, and the FTC Safeguards Rule is specific about the contents. The plan must address its goals, internal processes for responding to a security event, clear roles, responsibilities and decision-making authority, external and internal communications and information sharing, remediation of identified weaknesses, documentation and reporting of events and response activities, and evaluation and revision after an event (16 CFR 314.4(h)). The HIPAA Security Rule requires security incident procedures that identify and respond to suspected or known incidents, mitigate harm and document outcomes (45 CFR 164.308(a)(6)). PCI DSS 4.0.1 requires an incident response plan that includes notification of the payment brands and acquirers. That requirement sits in Requirement 12.10.1 (the standard is distributed by the PCI Security Standards Council, so confirm the wording in your own copy); see lesson 05 and your acquirer's rules. Federal guidance has moved on too. NIST published SP 800-61 Revision 3 in April 2025, replacing the 2012 Revision 2 and aligning incident response with CSF 2.0 (NIST).

A plan that works on a bad night is short. Executives rarely read past page three, and responders will not read past page one while the system is down. Put the call list and the decision rights up front, and keep the long procedures in appendices.

Roles

Role	Who, in a firm of 10 to 500	Decision right
Incident commander	Security lead, or the operations head if there is none	Declares the incident, sets severity, assigns work
Executive sponsor	CEO, owner or managing partner	Approves shutdowns, spending, payment decisions, public statements
Technical lead	IT manager or the managed provider's lead engineer	Containment steps, evidence handling, recovery order
Communications lead	Marketing, HR or the executive sponsor	Drafts notices and customer, staff and press messages
Compliance or privacy lead	Compliance officer, finance lead or privacy lead	Runs the notice clock table, tracks deadlines
Scribe	Anyone organized who is not doing technical work	Keeps the timeline with times and decisions
Outside contacts	Forensic firm, insurer hotline, IT provider, bank, key customers	Called by the incident commander, in the order on the card

Name a deputy for every role. Incidents do not wait for vacations. Put cell phone numbers on paper, and keep a copy outside your systems, because your email may be the thing that is down. CISA's guide says the same in its checklist: coordinate isolation with out-of-band communication, such as phone calls, so attackers do not learn they have been detected (CISA #StopRansomware Guide).

Severity levels

Level	Example	Who is told	Typical clock
1, minor	One phishing email reported, nobody clicked	Security lead	Log it; no outside notice
2, contained event	One account compromised, caught in an hour, no data copied	Incident commander, executive sponsor	Document the reasoning for no notice; keep evidence
3, significant	Malware on several machines, or mailbox with customer data accessed	Full response team, insurer	Compliance lead starts the notice clock table
4, major	Ransomware, data theft, systems down, regulated data involved	Everyone above, plus board chair, outside forensic firm, law enforcement	Several outside clocks running at once

Notice clocks: what starts when

The table below lists the main federal, sector, state and international clocks a mid-sized U.S. business meets. All entries were checked against primary text in October 2026 unless marked. A deadline is only a ceiling. Several of these laws also say "without unreasonable delay," and a regulator can ask why you took 29 days when you knew everything on day 5.

Law or rule	Who it covers	Notify whom	Deadline	Threshold or trigger
HIPAA Breach Notification Rule, 45 CFR 164.404 to 164.410	Covered entities (health plans, providers, clearinghouses); business associates notify the covered entity	Individuals; HHS; media if more than 500 residents of a state	Individuals and media: without unreasonable delay, no later than 60 calendar days after discovery. HHS: contemporaneously if 500 or more individuals; for fewer than 500, within 60 days after the end of the calendar year. Business associate to covered entity: also no later than 60 days	Breach of unsecured protected health information
FTC Safeguards Rule, 16 CFR 314.4(j)	Non-bank financial institutions under FTC jurisdiction (examples in the rule include auto dealers that lease, tax preparers, mortgage brokers, investment advisers)	FTC, by electronic form	As soon as possible, no later than 30 days after discovery	Notification event involving information of at least 500 consumers
FTC Health Breach Notification Rule, 16 CFR 318	Vendors of personal health records and related entities not covered by HIPAA	Individuals, FTC, media in some cases	No later than 60 calendar days after discovery; FTC at the same time as individuals if 500 or more, otherwise a logged annual notice within 60 days after year end	Breach of security of unsecured PHR identifiable health information
SEC Form 8-K Item 1.05	Public companies	SEC filing	Four business days after determining the incident is material; determination must be made without unreasonable delay	Material cybersecurity incident
SEC Regulation S-P amendments	Broker-dealers, investment companies, registered advisers, funding portals, transfer agents	Affected individuals; service providers must notify the institution within 72 hours	As soon as reasonably practicable, no later than 30 days after becoming aware. Compliance dates: December 3, 2025 for larger entities, June 3, 2026 for smaller entities (18 and 24 months after the June 3, 2024 publication)	Unauthorized access to or use of customer information likely to cause substantial harm
NYDFS Cybersecurity Regulation, 23 NYCRR 500.17	Entities licensed under New York banking, insurance or financial services law	NYDFS superintendent	72 hours after determining a cybersecurity incident occurred; 24 hours after an extortion payment, with a written explanation in 30 days	Cybersecurity incident as defined in the rule
GDPR Articles 33 and 34	Controllers and processors in scope (see lesson 08)	Supervisory authority; data subjects if high risk	Authority: without undue delay and where feasible within 72 hours of becoming aware; late notice must give reasons. Processor to controller: without undue delay	Breach likely to result in risk to individuals; high risk for individual notice
UK GDPR, ICO	Controllers in scope in the UK	ICO; individuals if high risk	No later than 72 hours after becoming aware	Breach likely to risk individuals' rights and freedoms
CIRCIA (proposed, not in force)	Covered entities in critical infrastructure sectors, per the April 2024 proposal	CISA	Proposed: 72 hours for a covered cyber incident, 24 hours for a ransom payment	Not binding until a final rule takes effect
Payment card brands, for example Visa	Merchants and service providers under card brand rules, through the acquirer	Acquiring bank immediately; Visa within 3 calendar days via the acquirer	Incident report to Visa and acquirer within 3 calendar days of notifying Visa; forensic investigator contract within 5 business days if Visa requires one	Suspected or confirmed compromise of account data

Visa's document, version 10.0, effective June 25, 2026, also says non-compliance assessments for Level 3 merchants are tiered, starting at $5,000 and rising to $100,000 at Visa's discretion, and that Level 1 and 2 merchants are more likely to be required to use a PCI Forensic Investigator (Visa). Other card brands publish their own rules, which I did not read in this session. Your acquirer's agreement controls.

State breach laws in brief

Lesson 07 covers all fifty states. Four examples show the range, as of October 2026.

State	Notice to residents	Notice to the state	Notes
Idaho (Idaho Code 28-51-104 to 107)	As soon as possible, in the most expedient time possible and without unreasonable delay, after a good-faith investigation finds misuse has occurred or is reasonably likely. No fixed day count	None for private businesses in section 28-51-105; public agencies must notify the Attorney General within 24 hours	Personal information is name plus an unencrypted Social Security number, Idaho driver's license or state ID number, or account or card number with any required security code. Intentional failure to give notice: fine up to $25,000 per breach
Colorado (C.R.S. 6-1-716)	Not later than 30 days after determining a breach occurred	Attorney General within the same 30 days if 500 or more residents	Consumer reporting agencies if more than 1,000 residents notified
Florida (Fla. Stat. 501.171)	No later than 30 days after determination or reason to believe a breach occurred	Department of Legal Affairs within 30 days if 500 or more Floridians; 15 more days allowed on written good cause	Third-party agents must notify the covered entity within 10 days. Civil penalties of $1,000 a day for the first 30 days, then $50,000 per 30-day period up to 180 days, capped at $500,000
Texas (Tex. Bus. and Com. Code 521.053)	Without unreasonable delay, no later than 60 days after determining a breach occurred	Attorney General as soon as practicable and within 30 days if 250 or more residents, through an electronic form	Consumer reporting agencies if more than 10,000 people notified
California (Civ. Code 1798.82, as amended by SB 446 effective January 1, 2026)	Within 30 calendar days of discovery or notification of the breach	Sample notice to the Attorney General within 15 calendar days of notifying consumers, if more than 500 residents	Private right of action under 1798.150: $100 to $750 per consumer per incident (adjusted periodically), with a 30-day cure notice
New York (Gen. Bus. Law 899-aa)	Most expedient time possible, within 30 days after discovery	Attorney General, Department of State and State Police; DFS if a covered entity	Consumer reporting agencies if more than 5,000 New Yorkers

Pay attention to the starting event, not only the day count. Colorado and Florida start the clock at a determination that a breach occurred. HIPAA, the Safeguards Rule and California start at discovery. A firm that "waits until forensics finish" can burn most of a 30-day window before it admits it has a breach. Regulators and plaintiffs read that delay closely. Write down the date and time the team first knew, and the date and time of any later determination, in the incident log.

Evidence: what to keep and how

Evidence decides three things: what happened, who must be told, and whether an insurer or regulator believes you. The first hour matters most, and the commonest error is helpful cleanup. CISA's guide says to disconnect affected devices by unplugging network cables or removing them from Wi-Fi, and to power down only if you cannot disconnect, because powering down destroys volatile memory evidence (CISA). Visa's compromise document gives matching advice for card environments: do not log in to or change compromised systems, do not turn them off or reboot them, isolate them from the network, document containment actions with dates and times, preferably in UTC, and ask cloud and hosting providers to keep their logs.

Forensic providers and the first call

A forensic firm answers three questions: how they got in, what they touched or took, and whether they are still there. It should also give you a written report you can hand to an insurer, a regulator or a card brand. Choose before you need one. The options are the insurer's panel, your MDR or IT provider's incident response arm, or an independent firm on a retainer. If a card brand requires a PCI Forensic Investigator, you cannot pick any firm. Visa's document says the investigator must be an approved PFI, and must not be affiliated with you or have provided services to you in the past three years, such as QSA, advisory or monitoring work. Visa also requires a signed PFI contract within 5 business days of the requirement (Visa).

Before signing, ask any forensic firm these questions. Who will actually do the work, and where are they based? What is the hourly rate, and is there a cap on a first estimate? Will the report be written for an outside reader? Will they work through your insurer's panel terms or separate from them? Keep the engagement letter with the incident file.

Law enforcement: FBI, CISA and the Secret Service

CISA's ransomware guide lists the reporting points: CISA at Central@cisa.gov or 1-844-729-2472, your local FBI field office, the FBI's Internet Crime Complaint Center at ic3.gov, and your local U.S. Secret Service field office. The FBI's own page says it does not support paying a ransom, and tells victims to report to a local field office and to IC3 (FBI). Visa's document directs card compromises in the United States to the Secret Service Electronic Crimes Task Force.

Agency	What it does for a victim	When it is most useful
FBI field office and IC3	Investigates crime, may hold decryption keys or know the actor, and runs the Recovery Asset Team for fraudulent wires	Ransomware, business email compromise, extortion, theft of data. In 2025, the Recovery Asset Team's Financial Fraud Kill Chain handled 3,900 incidents with $1,163,919,846 in attempted theft and froze $679,013,183, a 58 percent success rate (IC3 2025 report)
CISA	Gives technical help, shares indicators with other victims, and publishes alerts	Any incident where speed and shared intelligence matter; the voluntary reporting channel that CIRCIA would make mandatory for covered entities
U.S. Secret Service	Investigates financial and payment crime	Card compromise, wire fraud, payment-system intrusions

Wire fraud runs on hours. If a payment went to a fraudulent account, call the bank first, ask for a recall, and file with IC3 the same day. The 58 percent figure above covers cases that reached the Financial Fraud Kill Chain, so it is a best-case result for fast reporters. It does not describe what happens when the business waits three weeks.

Ransomware and the payment decision

The pressure to pay is strongest in the first 48 hours, when decisions are hardest to make well. Settle the principles before then, and write them into the plan.

First, the sanctions rule. On September 21, 2021, the Treasury Department's Office of Foreign Assets Control (OFAC) issued an updated advisory on ransomware payments. It says OFAC may impose civil penalties on a strict liability basis, so a person subject to U.S. jurisdiction can be liable even without knowing or having reason to know that the recipient was sanctioned. It names cyber insurers and digital forensics and incident response firms as companies that can facilitate payments. It treats a complete, prompt, self-initiated report to law enforcement and full, ongoing cooperation as significant mitigating factors, and it treats steps that reduce extortion risk, such as offline backups, incident response plans, training and authentication, as a significant mitigating factor too (OFAC advisory). I found no later replacement of that advisory in this session.

Second, the reliability of the criminals. Coveware's report for the second quarter of 2026, published July 29, 2026, says the share of victims paying hit a record low, that the average payment was $1,880,612 (up 176 percent from the first quarter because of a few unusually large data-theft payments) and the median was $150,000 (down 50 percent). It also argues that the usual advice to pay because stolen data will be deleted proved wrong, citing the LockBit takedown, which revealed that the group kept victims' stolen data despite its promises (Coveware). Coveware is a company that negotiates with attackers for victims, so treat its numbers as its own sample, not a census.

Third, the reporting duty that rides on a payment. NYDFS requires covered entities to notify it within 24 hours of an extortion payment and to explain in writing within 30 days why payment was necessary, what alternatives were considered, and what diligence was done, including on OFAC compliance (23 NYCRR 500.17). CIRCIA, if finalized as proposed, would add a 24-hour ransom payment report for covered entities.

Decision point	Who decides	Information needed before deciding	Record kept
Engage forensic and negotiation support	Executive sponsor with incident commander	Insurer panel terms, panel firm availability	Engagement letter, date and time
Report to law enforcement	Incident commander	Nothing further. Report early	IC3 confirmation, agent contact
Sanctions screening of the actor and wallet	Forensic or negotiation firm, with compliance lead	Group identification, OFAC list checks	Written screening result
Decide whether to pay	Executive sponsor, informed by the board chair	Can we restore from backups, what data was stolen, sanctions result, insurer position, regulatory notice duties	Decision memo with reasons, dated
Notices	Compliance lead	Facts on affected people and states	Notice clock table, copies of notices

Communications

Have the holding statement drafted before anything happens. A short one works: what the firm knows, what it does not know yet, what customers and staff should do now, where to ask questions, and when the next update will come. Keep names, speculation and blame out. Send staff the message first, because staff will be asked about it and will forward whatever they receive. Tell the same story to everyone, and update it when facts change. The FTC's data breach response guide for business is a free reference for notice letters and covers what to say and how to protect victims (FTC guide).

Plan for the slowest channel. If email is down, how does the executive team talk? How does payroll get told not to release a wire? Where does the call center send callers? A one-page script and a group text list beat a polished plan nobody can open.

Tabletop exercises

A tabletop is a two-hour, no-computers discussion. The facilitator reads a scenario in short injects, and each role says what it would do and what it would need. CISA offers more than 100 Tabletop Exercise Packages on request, with scenarios, discussion questions, templates and after-action report forms, covering ransomware, insider threats and phishing among others (CISA CTEP). Run one at least once a year and after any big change, and invite the executive sponsor. A tabletop with only IT in the room tests IT.

Lessons learned

The after-action review happens within two weeks, when memories are fresh and before the team moves on. The Safeguards Rule's own plan elements include evaluating and revising the plan after a security event. The review has one rule: no blame for honest mistakes, which keeps the next report coming (see lesson 10). Cover the timeline from first sign to full recovery, where detection should have happened earlier and why it did not, which decisions were slow and why, which notices went out late or contained errors, which tools or contacts were missing, and what it cost. Assign each fix to a named owner with a date, and report the open items at the next board meeting. See lesson 13 for the dashboard that tracks them.

The clock starts at discovery for most laws and at a later determination for a few. Check the starting event in the table above.

Questions and answers

Does the clock start when we first see an alert or when we confirm a breach?

It depends on the law. HIPAA, the Safeguards Rule and California start at discovery, and the Safeguards Rule defines discovery as the first day any employee, officer or agent (other than the person who committed the breach) knew of the event. Colorado and Florida start at a determination or reason to believe. Use the earliest defensible date as the working deadline, and document why later dates apply if you rely on them.

Do we need an outside MDR service if we have an IT provider?

Not always, but ask what your provider actually watches. Many IT contracts cover patching and help-desk work and do not include around-the-clock monitoring. If the answer is "business hours, email alerts," an attacker who arrives Friday night has the weekend.

Who should be on the incident response team in a 40-person company?

The owner or CEO, the person who runs IT or manages the IT provider, someone from finance or HR who can run communications and notices, and a scribe. Name deputies. Add the outside forensic firm and insurer hotline to the call list so they are one call away.

How often should we run a tabletop?

At least once a year, and again after a significant change such as a new payment system or merger. Short, repeated exercises beat one long one. Keep the attendance sheet and the after-action list.

If we are not a covered entity under HIPAA or the Safeguards Rule, are we off the hook?

No. State breach laws apply to nearly every business that holds residents' personal information, including Idaho's. Card brand rules apply to anyone who takes cards. Contracts with customers often contain their own notice periods, sometimes 24 or 72 hours, and those are separate from any statute.

What happens if we notify late?

The consequence depends on the law. Idaho allows a fine of up to $25,000 per breach for intentional failure to give notice. Florida's civil penalties run $1,000 a day for the first 30 days and then $50,000 for each further 30-day period up to 180 days, capped at $500,000 per breach. California allows consumers to bring suit for statutory damages of $100 to $750 per consumer per incident where the breach resulted from a failure to maintain reasonable security. Late notice also feeds regulators' view of the whole response.

Can law enforcement delay our notice?

Often, yes. Idaho allows delay when a law enforcement agency advises notice would impede a criminal investigation, with notice required as soon as the agency says the risk has passed. The Safeguards Rule provides for an initial delay of up to 30 days on an official's request, extendable by up to 60 more days if requested in writing. Get any delay request in writing and keep it.

Should we tell customers before we know the whole story?

When the law requires notice, send what you know with a promise to update. Phased notice is expressly allowed under GDPR Article 33(4) for regulators, and sensible everywhere else. Customers forgive an incomplete first message more readily than a second message that contradicts the first.

Does our cyber insurance cover the notice costs?

Most policies include breach response coverage for forensics, notice, call center and credit monitoring, subject to limits and a retention. Lesson 12 explains how to read the policy, and why a late notice of claim can matter.

Hard questions

"Detection tools and monitoring are expensive. We have never been breached. Why should we pay?"

You may have been breached and not seen it, and that is the problem. IBM's 2026 figures put the average global breach cost at $4.99 million, and a law-firm summary of the same report ties longer breach lifecycles to higher cost. Your own arithmetic may differ at your size. An MDR contract at, say, $30,000 a year is a defined cost. The alternative is an undefined one, plus an insurer that increasingly asks whether you have EDR before it quotes. Judge it against your risk appetite and the signed answer on your insurance application.

"If paying a ransom is legal in most cases, why do you stress the sanctions risk?"

Paying is not generally prohibited, but OFAC's rule is strict liability, which means ignorance is not a defense. The advisory lists sanctions screening and early law enforcement contact as the things that reduce risk. A firm that pays without screening, because the insurer or the negotiator said it was fine, takes on a risk it did not price. And the FBI's stated position is that it does not support paying.

"Our competitors do not make this much fuss about breaches. Is this overkill?"

You cannot see their incident logs or their insurers' premiums. What you can see are the public rules: HHS, the FTC, state attorneys general and card brands publish their requirements, and each can assess penalties. Preparation costs less than a bad first month. Preparing to the strictest clock you face also makes smaller incidents routine.

"Is it better to say nothing publicly and hope the incident stays quiet?"

Where a law requires notice, silence is a violation. Where it does not, the question is who will find out anyway: employees, customers whose data appears for sale, a security researcher, the attacker who posts on a leak site. A short, factual statement issued by you lands better than a story assembled by others. Silence is a choice, and it should be a deliberate one with the executive sponsor's name on it.

"The CIRCIA rule is not final. Can we ignore it?"

Do not treat it as binding yet, since reporting is not required until a final rule takes effect. Do not ignore it, either. The April 2024 proposal would apply to covered entities in critical infrastructure sectors and set a 72-hour incident report and a 24-hour ransom payment report. A July 2026 law-firm report said CISA expected to finalize the rule in September 2026, and as of October 19, 2026 the Federal Register search used for this lesson showed no final rule, only town hall notices and the August 2026 Unified Agenda. A secondary report dated October 8, 2026 (Paubox, citing federal review records) says CISA sent the draft final rule to the White House Office of Management and Budget on October 1, 2026 and that publication is expected by the end of 2026. I could not read the rule text, so what it changes from the proposal is unknown. If you are in a critical infrastructure sector, treat a 72-hour clock as a design target now, because the plan you build for it also serves GDPR and NYDFS.

"Why not just buy more insurance and skip the monitoring?"

Insurance pays after the fact and has conditions. Applications ask about the controls you run, and a policy can be contested if answers turn out to be wrong. Insurance also does not restore a lost customer, return your data from a leak site, or repair your reputation. Lesson 12 covers how policy terms and your controls interact.