Module 12 Lesson 4 of 6 🕑 ~40 min

> cat module-12-4-regulatory-architecture-incident-types.md

Regulatory, Architecture & Incident Types

A short but important lesson: the legal clock that starts ticking the moment personal data might be involved, what a full enterprise IR architecture actually looks like end to end, and the many incident types that aren't ransomware.

1 Global Regulatory Considerations

Incident responders don't normally make legal decisions themselves — but they need to understand that serious incidents can trigger reporting obligations with real deadlines, which is exactly why Legal and the Data Protection Officer should get pulled in early, not once the technical picture is fully clear. Requirements vary by jurisdiction, industry, and organisation, but the timing pressure is a consistent theme:

GDPR
Certain personal-data breaches must be reported to the relevant supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of the breach — unless it's unlikely to risk individuals' rights and freedoms.
NIS2
Staged reporting for significant incidents at covered entities: an early warning within 24 hours, an incident notification within 72 hours, and generally a final report within one month. Exact implementation depends on the relevant Member State's law.
SEC (US public companies)
A material cybersecurity incident generally requires Form 8-K disclosure within four business days — counted from when the company determines the incident is material, not from initial discovery.

Other countries and industries carry their own requirements on top of these. For a multinational incident, the company may need a dedicated regulatory workstream running in parallel with the technical response — incident response is not only a technical process, and treating it as one is exactly how a company misses a reporting deadline it didn't know existed.

2 Modern Enterprise IR Architecture

A mature enterprise's detection-to-response pipeline typically looks like this:

Enterprise incident response architecture with an animated alert travelling from endpoints through SIEM and SOC to incident response and forensics Endpoints (EDR) SIEM Email + Identity Cloud Logs SOC Incident Response

Telemetry from endpoints, email, identity and cloud all funnel into the SIEM; the SOC triages what comes out of it; confirmed incidents escalate to Incident Response, Forensics, Threat Intel and Security Engineering.

SOAR platforms (Module 11, Lesson 6) automate the repetitive parts of that flow: a malicious file alert triggers an automatic endpoint query, process-tree collection, threat-intelligence check, an enterprise-wide search for the same hash, ticket creation, and finally a request for analyst review — automation speeds up response, but human decision-making still has to make the actual call.

3 Legacy Enterprise Incident Response

Now picture the opposite environment: a global manufacturer running Windows 7 workstations, Windows Server 2008, older Cisco switches, AS400 applications, AIX servers, Oracle databases, no EDR, basic antivirus, local Windows Event Logs, a Syslog server, and old firewall appliances. Incident response becomes far more manual — an analyst may need to collect Windows event logs by hand, examine firewall logs directly, capture network traffic, review local scheduled tasks and running processes and service configuration, compare file hashes manually, review authentication logs, and interview administrators directly. This isn't a hypothetical extreme case; large organisations routinely contain both cutting-edge and decades-old technology side by side, and a real incident responder has to be able to work in both.

4 Incident Types Beyond Ransomware

Ransomware gets most of the attention, but IR procedures get triggered by a much wider range of incidents, each needing a different containment strategy.

Business Email Compromise
An executive or finance mailbox is compromised for invoice fraud, payroll diversion, data theft, or internal phishing.
Insider threat
An employee intentionally steals information (Module 8, Section 7).
Cloud compromise
An AWS access key is stolen.
Identity compromise
A global administrator account is hijacked.
Supply-chain incident
A trusted vendor or software update is compromised.
Web application attack
An Internet-facing application is exploited.
API credential theft
An API key or OAuth secret is stolen.
Database breach
A customer database is accessed directly.
Lost device
A laptop with sensitive information goes missing.
DDoS
Online services are overwhelmed with traffic.
OT incident
Manufacturing or industrial equipment is affected.

Lesson Outcome

You should now be able to name the GDPR/NIS2/SEC reporting timelines and explain why they push Legal into the response early, describe a modern enterprise's full detection-to-response pipeline and what SOAR automates within it, explain why legacy IR is inherently more manual, and recognise incident types beyond ransomware and how their containment needs differ. Lesson 5 puts everything from Lessons 1–4 together in one full, realistic ransomware case study.