When an incident is contained, a second phase begins. Systems are back, the attacker is out, and the organisation now has to explain what happened. Boards ask for a clear account. Regulators expect a reasoned assessment of risk to individuals. Insurers, auditors and sometimes courts want specifics. Almost all of these questions come back to one point: what happened to the data?
This article looks at why that question is so hard to answer with typical tooling, what good post-incident evidence looks like, and how decision records produced by per-use data control can help, with their limits stated plainly.
The evidence gap
Most security logging was built to answer operational questions. Who logged in? Which hosts talked to each other? Was a service available? These logs are valuable for detection and for reconstructing an attacker's path through infrastructure.
They are much weaker at answering data questions. Once a record has been exported, copied to a laptop, attached to an email or moved into another system, infrastructure logs usually stop at the edge. Teams are left estimating exposure from indirect signals: volumes transferred, folders touched, time windows. Estimates are sometimes the best available, but they make it hard to scope notifications precisely, hard to reassure stakeholders and hard to learn lessons.
What good evidence looks like
Useful post-incident evidence about data tends to share a few properties:
- Specific: it relates to identifiable records or record sets, not just systems.
- Contextual: it shows who or what requested use, from which device and environment, and for what stated purpose.
- Decision-based: it records what was allowed, what was refused and why.
- Time-aware: it reflects the security state at the moment of each decision, so behaviour before, during and after an incident can be compared.
- Honest about limits: it is clear about what it does not cover.
Decision records as evidence
If each use of selected data is evaluated against policy at the time of use, every evaluation naturally produces a record. That record can capture the requester's identity, the device, the environment, the declared purpose, the current security state and the outcome: allow, deny or degrade.
Taken together, these records give responders something rarely available today: a factual account of how protected data was used and which attempts were refused, rather than an inference from infrastructure logs. For data protection officers, they support accountability. For incident response teams, they help scope what needs further investigation. For boards, they make the conversation more concrete.
It is important to be precise about what this is. Decision records are technical control evidence. They are not a claims, underwriting or premium argument, and they do not by themselves establish legal conclusions. They should be read alongside other sources and with a clear understanding of what was and was not under policy.
Where PastWipe fits
PastWipe™ provides post-breach data control for enterprise and government. Policy stays attached to selected high-value data, and every use of a protected copy is re-checked against identity, device, environment, declared purpose and the current security state. Each allow, deny or degrade decision is recorded as evidence. PastWipe sits alongside existing controls and is designed for selected records rather than everything an organisation holds. The technology is US patent pending.
Because decisions reflect the current security state, an organisation can tighten policy during or after an incident, and the evidence will show the effect: which uses continued, which were degraded and which were refused.
Questions to ask before the next incident
Evidence is easiest to produce when it is planned for. A short exercise with security, legal and data protection colleagues can reveal gaps early:
- For our most sensitive record types, what evidence would we have of use after a copy left our systems?
- Could we distinguish legitimate use from misuse, or would we be estimating?
- If we changed our security posture during an incident, could we show what difference it made?
- Who needs this evidence (board, regulator, insurer, affected people) and in what form?
- What are the honest limits of the evidence we could produce?
Working through these questions in calm conditions is far easier than answering them for the first time in the middle of an incident.
See a sample decision record
You can explore sample decision records on fictional data, with no integration needed, in the PastWipe sandbox: https://pastwipe.com/sandbox