Managing Jurisdictions and Launching DINA

You can associate an incident with legal jurisdictions such as countries and states to build a visualization of impacted regions and their applicable local regulations. This allows you to identify the notification requirements of each impacted jurisdiction.

Once jurisdictions have been associated with the incident, you can launch the Dynamic Incident Notification Assessment (DINA). DINA is a questionnaire that assesses whether an incident requires an organization to notify the individuals or authorities affected by the incident. It provides context-aware questions that are specifically targeted to the jurisdictions in the scope of the incident. The Incident Management product provides notification guidance for each jurisdiction based on DINA responses. You can accept action options generated by the DINA to automatically create subtasks for notification response.

Note:

DINA only considers jurisdictions that are associated with the relevant incident record. You can manually associate a jurisdiction with an incident record by enabling jurisdictions in the Manage Jurisdictions modal on the Jurisdictions tab of the incident record.

3 Key Steps to Generate Guidance

  1. Manage Jurisdictions

    First, you must add the jurisdictions associated with the incident. For a full list of supported jurisdictions, see Supported Incident Jurisdictions. For step-by-step instructions on how to add jurisdictions, see To manage incident jurisdictions.

  2. Launch DINA

    Next, you should launch the assessment and answer questions related to the jurisdictions selected. For more information on the question responses required to display guidance for each jurisdiction, see Triggering Guidance Using DINA. For step-by-step instructions on how to launch DINA, see To launch a Dynamic Incident Notification Assessment.

  3. Review Notification Requirements

    Once the DINA is complete, you can accept actions generated by the guidance to automatically create subtasks for notification responses.

To manage incident jurisdictions

  1. On the Incident Management menu, select Incident Register.

    The Incident Register screen appears.

  2. Click the name of the incident in which you want to add jurisdictions.

    The Incident Details screen appears.


    Incident Details screen showing incident information and jurisdiction options.
  3. Click the Manage Jurisdiction button.

    The Manage Jurisdictions modal appears.

    Note:

    You can also click the Manage button on the Jurisdictions tab.

    If the Manage Jurisdiction button does not appear on the Summary tab, click the View All link to navigate to the Jurisdictions tab.


    Incident Details screen with the Manage Jurisdiction button highlighted.
  4. Select the check boxes for the impacted regions to configure the incident jurisdictions.
  5. Click the Update button.
  6. The selected jurisdictions will be highlighted on the Jurisdictions Map view and appear, by region, in the Jurisdictions List view.

    Jurisdictions Map view showing selected regions highlighted.

    Jurisdictions List view showing selected regions grouped by region.

To launch a Dynamic Incident Notification Assessment

The Dynamic Incident Notification Assessment (DINA) is a questionnaire that assesses whether an incident requires an organization to notify the individuals or authorities affected by the incident. The DINA provides context-aware questions that are specifically targeted to the jurisdictions in the scope of the incident. The Incident Management module provides notification guidance for each jurisdiction based on your DINA responses. You can accept action options generated by the DINA to automatically create subtasks for notification response.

  1. On the Incident Register screen, click the name of the incident in which you want to launch a DINA.

    The Incident Details screen appears.

    Note:

    Your jurisdictions must be managed before you can launch a DINA.

  2. Click the Assess Jurisdictions button.

    The Launch Dynamic Incident Notification Assessment modal appears.

    Note:

    The Assess Jurisdictions button will be disabled if the jurisdictions related to your incident do not require breach notifications. For a list of jurisdictions without notification requirements, see Supported Incident Jurisdictions.


    Launch Dynamic Incident Notification Assessment modal with the Assess Jurisdictions button highlighted
    Note:

    You can also access the Assess Jurisdictions button from the Jurisdictions tab.

  3. Enter a name for the DINA, then click the Launch button.

    The Dynamic Incident Notification Assessment screen appears.


    Dynamic Incident Notification Assessment screen with assessment questions displayed
  4. Complete the assessment. Several responses are required in order to submit the assessment. Depending on your responses, the DINA will populate additional questions to assess potential impacts and generate guidance accordingly.
    Tip:

    Use the table below as an overview of the guidance provided based on various response types.

    Response

    Guidance Impact

    Yes

    Selecting this response will generate guidance.

    No

    Selecting this response will not generate guidance.

    Unlikely to Result in a Risk

    Selecting this response will not generate guidance.

    Likely to Result in a Risk

    Selecting this response will generate guidance depending on the rules of the specific jurisdiction.

    Highly Likely to Result in a Risk

    Selecting this response will generate guidance.

    Negligible

    Selecting this response will not generate guidance.

    Limited

    Selecting this response will generate guidance depending on the rules of the specific jurisdiction.

    Significant

    Selecting this response will generate guidance.

    Maximum

    Selecting this response will generate guidance.

    Not Sure

    Selecting this response will generate guidance.

    Not Applicable

    Selecting this response will not generate guidance.

    For more information on how to trigger specific guidance, see Triggering Guidance Using the Dynamic Incident Notification Assessment.

  5. When finished with the assessment, click the Generate Guidance button. OneTrust will analyze your responses, compare them against potential impacts, and generate guidance.

    The Incident Details appears.


    Incident Details screen with generated guidance displayed
  6. Click the name of a jurisdiction to view its notification requirements.

    The Jurisdiction Details screen appears.


    Jurisdiction Details screen showing notification requirements for a selected jurisdiction
  7. Review the generated guidance text to decide if you want to create the suggested task action(s). Click the Accept button for each guidance you would like to accept to create the task. An email notification will be sent to the assignee alerting them to the task.

    Incident Details screen showing generated guidance with Accept buttons for each suggested task action
    Note:

    You can return to the DINA and update your responses as necessary to generate new guidance. Locate the Assessments block and select the DINA. Update your assessment responses, then click the Generate Guidance button to refresh the generated guidance text and subtask options.

  8. If you want to dismiss the task option, click the Reject button.

    The Reject Guidance modal appears.


    Incident Details screen showing generated guidance with Accept buttons for each suggested task action.
  9. Provide a reason in the text editor as to why you rejected the subtask option. Then, click the Reject button.
  10. The rejection response will be displayed in the notification requirements block.

    Incident Details screen showing notification requirements block with rejection response displayed
  11. Repeat steps 6-10 for all jurisdictions.

Best Practices and Expert Advice

Assessing Jurisdictions

When you conclude the investigation into the incident and determine the scope, you are able to view the affected jurisdictions. Jurisdictions are assessed based on the urgency of the incident. You should assess the jurisdiction and generate guidance before reviewing the list of subtasks created for addressing guidance.

Creating Tasks

Create a task in your automated workflow to remind users to start the process of generating and addressing guidance for each jurisdiction. To ensure consistency, this process should be followed for all incidents and breaches. Having an automated workflow will help remind you to begin the process for each incident captured.

Map and List Views

The map view displays the urgency levels of notifying individuals or authorities about a breach by jurisdiction. This view is interactive, meaning it gives you the ability to view the state of individual jurisdictions by hovering over the highlighted area on the map. You can click the highlighted area to open the Jurisdiction Details screen. When you click a specific country or state, a detailed view appears to show you jurisdiction details per country/state.





The list view of guidance results helps you to determine notification obligations. This view shows the jurisdictions affected by the incident and helps you to define the urgency level of notifying individuals and authorities about the incident. Click into a jurisdiction to review the jurisdiction details and description. You can track the guidance addressed on the List View screen.