Cyber Decision LedgerDecision area
Regulatory
4 public Decision Records in the whole ledger carry this label. Back to the full Ledger →
Decision Records
Determining contract-based cyber reporting obligations
Determine contract-based cyber reporting obligations by involving legal and contracting personnel, mapping affected systems and subcontractors to controlling clauses and agency channels, and identifying the responsible record owner and contracting officer. Do not state a specific contractual deadline until the applicable contract and reporting provision have been verified.
Verification controls for government data requests
Government data requests should undergo independently sourced out-of-band verification, separate confirmation of the case and legal authority, dual Legal and Privacy approval, data minimisation, secure transfer, and immutable logging before disclosure.
Jurisdiction mapping before U.S. school breach notices
For a U.S. school incident, map affected individuals, data, and jurisdictions with counsel before setting notification obligations or deadlines. Do not assume that one federal threshold applies nationwide.
Review reliance on Connective Belgian eID signatures
Organizations using affected Connective Belgian eID signing workflows should verify patch status against current vendor guidance, preserve signing logs and transaction metadata, consider a risk-tiered pause for high-value remote signing until verified, and conduct a case-specific reliance review with appropriate legal and operational stakeholders before deciding whether any transaction needs caveats or re-execution.