[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-253437-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-253437-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","2021-data-security-incident-response-report-key-findings","2021 Data Security Incident Response Report - Key Findings","","2021 Data Security Incident Response Report examines disruption and transformation across digital transformation, healthcare privacy and compliance, and broader digital risk advisory and cybersecurity themes. It highlights practical security actions such as enabling MFA, strengthening IAM/PAM, addressing C-SCRM supply chain risk, maintaining attorney-client work product for forensics, and applying zero-trust with defense-in-depth. The report also covers legacy data remediation, phishing and phishing training, endpoint detection and response, eCrime trends, and board-ready cybersecurity metrics, alongside ransomware, litigation, vendor incidents, regulatory updates, work-from-home governance, and CCPA developments.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/2021-data-security-incident-response-report-key-findings/253437/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/2021-data-security-incident-response-report-key-findings/253437.png","ImageObject",442,249,{"name":42,"@type":43},"Rizky","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-27","2026-09-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",10,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Why does the report emphasize enabling MFA and adding a second authentication factor?","Question",{"text":63,"@type":64},"It stresses that when sign-in provides access to sensitive data, source code, or critical services, stronger authentication reduces the risk of account compromise.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does the report frame zero-trust?",{"text":68,"@type":64},"It recommends treating zero-trust as a strategic priority by assuming breach and applying a defense-in-depth approach rather than viewing it as a fad.",{"name":70,"@type":61,"acceptedAnswer":71},"What areas does the report cover beyond incident response operations?",{"text":72,"@type":64},"It includes forensics and litigation considerations, attorney-client/work product preservation, work-from-home and information governance, vendor incidents, regulatory updates such as CCPA and EU updates, and sector-specific issues like healthcare and advertising/marketing/digital media.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},253437,1791353743,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":119,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":141},962085564807,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","2021 Data Security Incident Response Report  \n2021 DATA SECURITY INCIDENT RESPONSE REPORT  \nDigital Assets and Data Management – Disruption and Transformation  \nDigital Transformation  \nand Data Economy  \nHealthcare Privacy and Compliance  \nDigital Risk Advisory and Cybersecurity  \nEmerging  \nTechnology  \nPrivacy Governance and Technology Transactions  \nPrivacy and Digital Risk Class Action and Litigation  \nAdvertising, Marketing and Digital Media  \nKey Findings  \nDid we say, \"Enable MFA\"?  \nIt bears repeating. And not just for email—add a second authentication factor where sign-in gives access to sensitive data, source code, or critical operational services.  \nIAM/PAM (identity access management and privileged access management). Are these on your road map?  \nC-SCRM? Cybersecurity – supply chain risk management. Read the events in the news and layer in technology usage trends, and it’s obvious why this long-standing challenge is even more important to address.  \nAttorney-client and work product. Establishing and preserving these for forensic investigations of security incidents remains a challenge. Focus on separating underlying facts from communications regarding advice.  \nZero-trust: strategic priority or fad? If you define it as assume abreach and implement a defense-in-depth approach, it should be a priority.  \nOld data. Get rid of it. Old data on a file server is the most common source of notice obligations in ransomware matters.  \nPhishing training.  \nPhishing is still prevalent, so are awareness training and measures like marking emails as from an \"external sender\"making a difference?  \nEndpoint detection and response (EDR). It is hard to argue against the need for an endpoint threat detection and response tool.  \neCrime continues. From wire transfer schemes (the first 48 hours is the critical time for seeking recovery) to W2 phishing to fraudulent unemployment claims to payment card data theft (with a rise in e-commerce and slowing of card present theft) .  \nWhat are meaningful cybersecurity metrics for boards? Boards need to know more than the patched vulnerability counts and number of pings dropped by a firewall to properly oversee the management of acybersecurity program.  \nDisruption. Pandemicand technology-driven changes occurred.  \nCCPA. The Biometric Information Privacy Act (BIPA)-like flood of California Consumer Privacy Act (CCPA) lawsuits that was widely expected has not yet materialized.  \nRansomware scourge.  \nEntities are still being victimized and paying ransoms for decryption keys and to avoid the publication of exfiltrated information.  \nSmall actions. The trend of filing lawsuits over small incidents continued, especially in notifications to current and former employees involving theft of Social Security numbers (SSNs) .  \nCONTENTS  \n02 At A Glance  \n04 Why Incidents Occur  \n06 Incident Response Life Cycle  \n07 Forensics  \n08 Litigation  \n10 Work From Home/ Information Governance  \n11 Vendor Incidents  \n12 CCPA  \n13 EU Regulatory Update  \n14 Healthcare  \n15 Advertising, Marketing and Digital Media  \n16 Security  \nCLIENTS AND FRIENDS OF THE FIRM  \nWelcome to our seventh Data Security Incident Response Report (DSIR) . It has been quite a year from many perspectives. Thank you to everyone we have continued to partner and work with to create this report.  \nWe are excited to soon launch a new digital platform version, and we intend to update this version throughout the year with real-time data. The DSIR will continue to share data and insights about security incidents, regulatory enforcement actions, class actions, transactions, digital innovation, compliance projects, data governance, and advisory matters to help organizations develop solutions to address the issues that data and technology create.  \nWe kicked off 2020 with the formation of a practice group focused on “everything data”—the Digital Assets and Data Management (DADM) Practice Group. At that time, no other law firm had prioritized these issue","cbCaiqtzzmA0pO0y","https://ap.wps.com/l/cbCaiqtzzmA0pO0y","pdf",260228,"English","# Key Findings\n## Did we say \"Enable MFA\"?\n## IAM/PAM and C-SCRM\n## Forensics, Litigation, and Zero-Trust\n## Old Data, Phishing Training, and EDR\n## Cybersecurity Metrics for Boards\n## Disruption and Pandemic Impact\n## CCPA and Regulatory Updates\n## Healthcare and Advertising, Marketing and Digital Media\n## Security, Vendor Incidents, and Work From Home/Information Governance","[{\"question\":\"Why does the report emphasize enabling MFA and adding a second authentication factor?\",\"answer\":\"It stresses that when sign-in provides access to sensitive data, source code, or critical services, stronger authentication reduces the risk of account compromise.\"},{\"question\":\"How does the report frame zero-trust?\",\"answer\":\"It recommends treating zero-trust as a strategic priority by assuming breach and applying a defense-in-depth approach rather than viewing it as a fad.\"},{\"question\":\"What areas does the report cover beyond incident response operations?\",\"answer\":\"It includes forensics and litigation considerations, attorney-client/work product preservation, work-from-home and information governance, vendor incidents, regulatory updates such as CCPA and EU updates, and sector-specific issues like healthcare and advertising/marketing/digital media.\"}]","2021 Data Security Incident Response Report - Key Findings | PDF",1789266028,7]