Initial and follow-up cyber incident reports: explanations and updates to customers and business partners

Scope of this article: This article does not cover reports to authorities, notifications to the individuals concerned, or timely disclosure (these are covered in Section 3 of Cyber Incident and Data Breach Response). Its scope is limited to business-to-business (B2B) explanations.

The following is a fictional scenario. An anomaly has occurred in the order and inventory system of Company A (a manufacturer with 300 employees, preparing for a stock exchange listing), and Company B, the vendor to which operation and maintenance have been outsourced, has also reported suspected unauthorized access. It is not yet known whether any information has leaked. At this stage, Company C, a corporate customer, has sent inquiries asking "Has our order data been affected?" and "When will the system be restored?", with a deadline for the response. This article discusses what Company A tells Company C, how much detail it provides, and how it later corrects and updates its explanations.

Company A, Company B, and the other elements of the scenario in this article are fictional and used for explanatory purposes. They do not describe actual matters handled by our firm.

When a business partner sets a deadline for an explanation or response

Business-to-business inquiries fall broadly into four categories: whether the counterparty's data has been affected, the timing of restoration, the cause and measures to prevent recurrence, and the provision of materials such as investigation reports.

There is a distinctive feature of the situation companies face at this stage: the deadline for responding arrives before they have an answer. Deadlines under laws, regulations, or contracts, or response dates requested by business partners, may arrive before the investigation is complete. For each deadline or response date, please set out its basis, the date, and any room for adjustment. Deadlines under laws, regulations, or contracts differ in nature from response dates requested by a counterparty. Failure to meet the former may raise issues of violations of laws or regulations or breaches of contract, whereas the latter allow room for adjustment within the business relationship.

Another issue that is more likely to arise in a company with separate departmental functions is that responses are sent without a single point of contact being established. When a sales representative receives an inquiry, responding with information that has not been verified may make a later correction necessary.

External explanations about an incident begin with deciding who will provide them and through which channel.

→ Designating approvers and alternates within the company

Checking contracts, known facts, and the impact on the counterparty

Checking where contractual notification obligations are set out

Business-to-business explanations include voluntary explanations and notifications required by contract. The two differ in nature and are therefore separated at the outset.

Notification clauses may appear not only in a master agreement but also in an individual agreement, an SLA, a confidentiality agreement, or a memorandum on the handling of personal data. The points to check are the notification deadline ("immediately", "without delay", or "within [number] days"), the recipient of the notification, and whether the matters to be notified are specified.

If the company performs work entrusted to it, the duty of a mandatary to report on the status of that work may be at issue even if the contract contains no notification clause (Article 645 of the Civil Code; under Article 656 of the Civil Code, this provision also applies mutatis mutandis to entrusted work that does not constitute a juridical act).

Distinguishing facts established at the time of the explanation

Before deciding on the content of an explanation, the information at hand is divided into three categories: verified facts, unverified matters, and assessments and speculation.

The purpose of this classification is to organize the content of the explanation, not to provide internal speculation or legal assessments to the counterparty as they stand. Also, even if the information is organized in the same way, the extent of the response is decided separately for each counterparty. The decision takes into account the scope of contractual obligations and how the content of the explanation affects later discussions of liability.

For unverified matters, the explanation states the reference point in time, the reasons they remain unverified and the status of the investigation, and the planned timing of the next update. Facts already known are not grouped together with these matters as "unverified". This classification provides no basis for omitting notifications required by contract or for forgoing necessary investigations.

→ When an authority makes an inquiry or requests a report

Checking the impact on each counterparty

The content of the response varies by counterparty. The checks cover whether the company holds data entrusted to it by that counterparty and, if so, the types of data, whether there are connections between the systems, and whether reporting or notification obligations may arise for the counterparty itself.

If the company has been entrusted with the handling of personal data, separate consideration is needed for the counterparty to fulfill its obligations.

→ When further checks with a vendor are needed

Separating contractual notifications from responses to individual questions

Contractual notifications

The timing, content, and method of contractual notification are checked. If some matters have not yet been determined, an initial report separating known facts from matters not yet determined, and methods of providing further reports, are considered. Sending a communication that expressly identifies matters not yet determined does not, by itself, necessarily fulfill the notification obligation. Since deferring notification until the investigation is complete may result in failure to meet a deadline, information gathering and the steps needed for notification proceed in parallel.

Responses to individual questions

Questions are divided into three categories: those that can be answered now, those that cannot be answered now, and those that will be answered after the investigation is complete. For questions that cannot be answered, indicating when a response is expected to be possible is a practical way of seeking the counterparty's understanding.

Caution is needed when stating, "There is no impact". The counterparty uses that statement as a basis for deciding its own response. When making that statement, please also indicate the scope of the checks on which it is based, the methods used, and the point in time up to which those checks extended.

Also, not finding evidence of an information leak is not the same as no information leak having occurred. It is not uncommon to be unable to verify matters because, for example, logs were not retained or were outside the scope of collection. Matters that could not be verified are not presented as verified findings.

Wording concerning commitments or liability

Please do not make commitments on the timing of restoration, completion of measures to prevent recurrence, or the scope of compensation where these matters have not yet been determined. Because the counterparty makes its own decisions on the basis of those commitments, the burden of reversing them later is greater than that of choosing cautious wording at the outset.

Wording that could be read as an admission of liability is also avoided before it is clear where liability lies. Expressions such as "due to our negligence" or "for which our company is responsible" may be relied on in later negotiations or disputes as statements admitting liability. Whether a statement is relied on and whether liability is established are separate matters, but please distinguish in writing between descriptions of facts, expressions of regret, and admissions or denials of liability.

Determining who handles and approves responses, corrections, and updates

A single point of contact is established. Because inquiries from business partners may reach the sales department, its role of forwarding inquiries it receives to the incident response office is made clear in advance.

After technical staff conduct fact-finding and legal staff check the contract, the division head who has been authorized to provide explanations approves the draft response. Approval is obtained again when the explanation of the cause is corrected or a new commitment is added.

When the same response is given to many business partners, a standard response is prepared and the portions requiring adjustment for each counterparty are identified separately. Since the types of data the company holds for each counterparty and the contract terms differ between counterparties, a response sent without adjustment is inaccurate.

A counterparty may also ask for a signature on a written response or written confirmation. Whether to agree to sign depends on whether the document is limited to confirming facts or includes confirmation of obligations or liability.

→ Arrangements for an alternate in an authorized approver's absence and clarification of authority across the company

Keeping records that link outgoing communications to their basis, reasons for changes, and recipients

What matters in records of external explanations is maintaining the ability to trace who was told what. When new facts come to light, a correction cannot be made if those who need to receive it cannot be identified.

The following items are recorded:

• Date and time sent, and recipient
• Original text of the document sent
• Materials relied on at that time
• Drafter and approver
• If the content was changed, the reason for the change and the recipients to whom it was resent

The date and time a communication was sent and the date and time the record was created are recorded separately. When a correction is made later, the original communication is retained, and the scope of the correction, the date and time it was made, the person who made it, and the reason for it are recorded. If only a new explanation is sent without referring to the previous one, the counterparty may not even realize that a change has been made.

The following comparison shows an initial report and a follow-up report for the same fictional scenario.

Item	Initial report (day 2 of the incident)	Follow-up report (day 12 of the incident)	Reason for change
Known facts	Unauthorized access to a specific server confirmed	A vulnerability in VPN equipment identified as the entry point	Based on an interim investigation report
Impact on your company's data	Impact not confirmed at this stage (scope checked: [system] logs through [date])	Traces of access to some files confirmed	Expansion of the scope of log analysis
Expected restoration	Not yet determined	Target: [date]	Completion of setup for an alternative environment
Next communication	In [number] days	When the investigation is complete	—

Note: These are illustrative entries for a fictional scenario. They show how the items correspond and do not constitute a notification that can be used as written. What needs to be included varies with the contract terms and the circumstances of the case.

→ How to explain facts that the investigation has not established

When asked for commitments or a response on compensation

In situations such as the following, we recommend considering the matter together with an analysis of the legal issues before responding.

• Where a business partner has indicated the possibility of suspending dealings, terminating the contract, or seeking damages
• Where interpretations differ as to the scope or deadlines of contractual notification obligations
• Where the content of a response could affect later discussions of liability
• Where the counterparty requests written commitments concerning compensation or measures to prevent recurrence

There are aspects with which lawyers can assist at the stage of deciding whether contractual notification is required and whether commitments can be made, with those decisions informed by the assessments of the provider conducting the technical investigation.

→ When compensation is requested in addition to an explanation

→ Checking reporting and notification obligations and the overall response

Contact

Making an inquiry

Please let us know, as far as you are able, an outline of the explanation requested by the business partner and the deadline for responding; what has already been communicated; and the points requiring correction or further explanation.

Contact Form

In your first message, please tell us the name of your company, the names of the parties involved and an outline of the matter. We will let you know whether we can advise after checking for conflicts of interest and similar matters. This form is not an emergency contact point, and we may not be able to review or reply to your message immediately after it is sent.

Related information

Related explainers and practice areas

A cyber incident at a vendor: requesting information to assess the impact on the company

Outlines additional questions for the vendor and methods of verification when there is insufficient information to provide explanations to customers and business partners.

Customer compensation and recovery costs after a cyber incident: records for liability allocation and recourse

Outlines the records needed for spending decisions and for later consideration of cost allocation when customers request compensation.

Responding to Regulatory Investigations and Dawn Raids

Outlines responses, document submissions, and internal response arrangements when the company receives inquiries or is investigated by the regulatory authorities.

This article is provided for general informational purposes only and does not constitute legal advice on any specific matter. Please consult us regarding your specific situation. The content is based on the laws and regulations in effect as of the date of the last update.