SOAR Breach Response add-on updates V1.10.27

The SOAR Breach Response add-on includes updated regulators and a new regulator in this release.

We always appreciate feedback on current legislation and guidance whether it appears in our product or not. Contact your Customer Relationship Manager if you have any questions about these updates or suggestions for future updates. You can also use the IBM Community to see how your peers are using the Privacy solution to simplify the complex world of information security.

The following regulators were updated in this release.

Regulator	Description
US
Pennsylvania	Updated this regulator to reflect SB 824 that took effect on September 26, 2024. Specifically, updated relevant provisions of Breach of Data Protection Notification Act in the Resource Library; updated the number count threshold for Notify Credit Bureaus (PA) task from "more than 1000" to "more than 500"; added Notify PA AG task to be triggered when the breach involves more than 500 PA residents; updated the language of Notify PA Consumer Individually task by narrowing the scope of medical data and adding the obligation of providing 12 months of credit monitoring services and access to one credit report when the breach is likely to cause identity theft.

Regulator

Description

Pennsylvania

Updated this regulator to reflect SB 824 that took effect on September 26, 2024. Specifically, updated relevant provisions of Breach of Data Protection Notification Act in the Resource Library; updated the number count threshold for Notify Credit Bureaus (PA) task from "more than 1000" to "more than 500"; added Notify PA AG task to be triggered when the breach involves more than 500 PA residents; updated the language of Notify PA Consumer Individually task by narrowing the scope of medical data and adding the obligation of providing 12 months of credit monitoring services and access to one credit report when the breach is likely to cause identity theft.

The following regulators were added in this release.

Regulator	Description
Europe
NIS2	Added the Network Information Security Directive (NIS2) that has an implementation date of October 17, 2024. NIS2 applies to the 27 European Union member states. Added excerpts of the NIS2 Directive to each Resources Library and added the following tasks to each EU Member state to reflect notification criteria in the event of a serious incident: Notify Competent Authority: Significant Incident Early Warning (NIS2), Notify Competent Authority: Significant Incident Intermediate Report (NIS2), Notify Competent Authority: Significant Incident Final Report (NIS2), Notify Competent Authority: Significant Incident Progress Report (NIS2).

Regulator

Description

Europe

NIS2

Added the Network Information Security Directive (NIS2) that has an implementation date of October 17, 2024. NIS2 applies to the 27 European Union member states. Added excerpts of the NIS2 Directive to each Resources Library and added the following tasks to each EU Member state to reflect notification criteria in the event of a serious incident: Notify Competent Authority: Significant Incident Early Warning (NIS2), Notify Competent Authority: Significant Incident Intermediate Report (NIS2), Notify Competent Authority: Significant Incident Final Report (NIS2), Notify Competent Authority: Significant Incident Progress Report (NIS2).