Breach response data management system and method

1. A method for responding to cyber events, comprising:

receiving, using a processor that processes instructions stored in a memory and from a configuration management system comprising information regarding information technology items, configuration information of a configuration item of the information technology items;

identifying, by the processor, using the configuration information of the configuration item, a violation of an authority, wherein the authority is associated with at least two of a type of incident, a data classification, and a jurisdiction,

wherein the type of incident is selected from a set of incident types including a first incident type of loss or theft of data and a second incident type of illegal access to systems or information and the data classification,

wherein the data classification is selected from a set of data classifications including a first classification of personal information and a second classification of private data, and

wherein the jurisdiction comprises at least one country or at least one state;

identifying a cyber event in response to identifying the violation;

identifying a playbook of tasks,

wherein the playbook constitutes a response to the cyber event, and

wherein a task of the tasks is assignable to a user group;

receiving, by the processor, from a user of the user group, a completion of the task;

receiving, by the processor, a proof of completion of the task;

receiving, by the processor, a first document constituting the authority;

creating, by the processor, one or more playbooks of tasks based on the first document;

receiving, by the processor, a second document constituting a revision of the authority;

identifying, by the processor, differences between the first document and the second document; and

based on the differences, updating, by the processor, at least one of the one or more playbooks of tasks.

2. The method of claim 1 , wherein the user is an automated agent.

3. The method of claim 1 ,

wherein the authority is at least one of a law, a regulation, a contract, an information technology control, or a policy, and

wherein the violation is a violation of at least one a preventive requirement, a configuration requirement, or a reporting requirement relating to the configuration item.

4. The method of claim 1 , further comprising:

receiving an intelligence feed comprising information related to potential or current cyber events;

identifying an asset in the configuration management system based on the intelligence feed; and

identifying another cyber event based on the asset and the intelligence feed.

5. The method of claim 1 , further comprising:

receiving an intelligence feed; and

associating an intelligence report, from the intelligence feed, with the playbook.

6. The method of claim 1 , further comprising:

receiving another event from at least one of a change management system, a records management system, or a security information and event management system.

7. A non-transitory computer-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations for responding to cyber events, comprising:

receiving a first document constituting an authority;

creating a playbook of tasks based on the first document;

receiving an incident of a cyber event by operations comprising:

receiving, from a configuration management system comprising information regarding information technology items, configuration information of a configuration item of the information technology items, wherein the configuration information comprises information related to personal information comprising at least one of personally identifiable information, personal health information, or protected personal information; and

identifying the incident of the cyber event, using the configuration information, wherein the incident identifies a violated rule related to the personal information;

identifying, based on the incident, the playbook of the tasks;

receiving a proof of completion of the task;

receiving a second document constituting a revision of the authority;

identifying differences between the first document and the second document; and

based on the differences, updating the playbook of the tasks.

8. The non-transitory computer-readable storage medium of claim 7 , wherein the proof of completion of the task is received from a user.

9. The non-transitory computer-readable storage medium of claim 7 , the operations further comprising:

generating a compliance report including the task and the proof of completion.

10. The non-transitory computer-readable storage medium of claim 7 , wherein identifying, based on the incident, the tasks comprising:

determining a violated authority based on the configuration information; and

identifying the tasks based on the violated authority.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the violated authority is one of a regulation, a policy, an IT control, or a contractual obligation.

12. The non-transitory computer-readable storage medium of claim 10 , wherein the violated authority is a contractual obligation, and the operations further comprising:

receiving a contract document from a procurement system; and

associating a playbook with the contractual obligation in response to an analysis of the contract document.

13. A system for responding to cyber events, comprising:

a memory; and

a processor, the processor configured to execute instructions stored in the memory to:

receive a first document constituting an authority;

create a playbook of tasks based on the first document,

wherein the playbook constitutes a response to a cyber event, and

wherein a task of the tasks is assignable to a user;

receive an intelligence feed comprising an incoming stream of information related to potential or current cyber events;

identify, in response to receiving the intelligence feed and based on information in the intelligence feed, the cyber event based on the intelligence feed;

identify, based on the cyber event, the playbook of tasks;

receive a proof of completion of the task;

generate a compliance report including the task and the proof of completion

receive a second document constituting a revision of the authority;

identify differences between the first document and the second document; and

based on the differences, update the more playbook of tasks.

14. The system of claim 13 , wherein the user is an automated agent.

15. The system of claim 13 , wherein the instructions further comprise instructions to:

receive, from a configuration management system, asset information for an asset,

wherein the asset represents an information technology component and the configuration management system comprises attributes of the information technology component, and

wherein the configuration management system comprises information relating to information technology components including clients devices, load balancers, application servers, database servers, or databases;

identify, using at least one of the asset information or the asset, a violation of the authority; and

identify another cyber event in response to identifying the violation.

16. The system of claim 13 , wherein to identify the cyber event based on the intelligence feed comprises to:

identify an asset in a configuration management database based on the intelligence feed; and

identify the cyber event based on the asset and the intelligence feed.

17. The system of claim 13 , wherein the instructions further comprise instructions to:

receive another intelligence feed; and

associate an intelligence report, from the another intelligence feed, with the playbook.

18. The system of claim 13 , wherein the instructions further comprise instructions to:

receive another cyber event from at least one of a configuration management system, a change management system, a records management system, or a security information and event management system.

19. A method for responding to incidents, comprising:

receiving a first document constituting an authority and having a first effective date;

creating a playbook of tasks based on the first document,

wherein at least some of the tasks of the playbook are to be completed in response to an incident,

wherein the playbook is associated with a type of incident, a data classification, and a jurisdiction,

wherein the type of incident is selected from a set of incident types including a first incident type of loss or theft of data and a second incident type of illegal access to systems or information and the data classification,

wherein the data classification is selected from a set of data classifications including a first classification of personal information and a second classification of private data, and

wherein the jurisdiction comprises at least one country or at least one state;

receiving a second document constituting a revision of the authority and having a second effective date that is later than the first effective date;

identifying differences between the first document and the second document;

based on the differences, creating a new version of the playbook of tasks, wherein creating the new version of the playbook comprises at least one

excluding a first task of the playbook from the new version of the playbook,

adding to the new version an updated task of a second task of the playbook, or

adding a third task to the new version, wherein the third task is not in the playbook of tasks;

in response to receiving a first incident before the second effective date and after creating the new version of the playbook of tasks, using the playbook of tasks to respond to the first incident; and

in response to receiving a second incident after the second effective date, using the new version of the playbook of tasks to respond to the second incident.