Immediate Reporting of Serious Security Incidents: Preparation, Responsibilities and Documentation

A serious security incident may require immediate notification to Israel's Privacy Protection Authority while you also limit disruption to operations and customer service. Prepare database classifications, assign responsibilities and create a reporting template you can use even when information is incomplete. This guide covers preparation, initial reporting, containment and exercises, with deliverables to verify completion of each stage.

Assess reporting obligations while containing the incident

Assess the need to report while limiting exposure and maintaining customer service. The Privacy Protection Authority's reporting service states that serious security incidents must be reported immediately and refers to regulation 11(d) of Israel's Privacy Protection (Data Security) Regulations, 5777–2017.

Ask legal counsel to assess your exposure under applicable law and the circumstances of the incident.

Menora learned of the incident on 12.11.2025 and reported it on 27.11.2025. Meuhedet learned of the incident in November 2025 and reported it on 27.1.2026.

Operational documentation and reporting thresholds under the Authority's guidance

As an operational recommendation, document alerts, facts, decisions and actions even before a reporting obligation has been established. According to the Authority's reporting service guidance, at the medium security level, reporting is required when a substantial portion of the database is used without authorization or beyond the scope of authorization, including disclosure, copying, transfer or provision of information, or when a copy of the information is created. The guidance also covers harm to the integrity of information in a substantial portion of the database, including encryption or denial of access, even when the copy remains within the database systems.

At the high security level, the Authority's guidance covers entry into database systems that enables access to information without authorization or beyond the scope of authorization, even without proof of actual use. It also covers such access when there is no way to determine the extent or duration of exposure or the actions performed. The absence of proof of copying is therefore insufficient to rule out a reporting obligation. Confirm the database's security level and applicable obligations with legal counsel; if the service page conflicts with the law, the law takes precedence.

Business scenario to investigate	Questions to establish and document
Open SharePoint link	What information is accessible, to whom, from which database, and are access records available?
Compromised Microsoft 365 account	Which mailboxes and files were accessible, and did permissions or forwarding rules change?
CRM export sent by mistake	Who received the file, how extensive is it, and was an unauthorized copy created?
Incorrect payroll-system permission	Who could view which data, and for how long?
Ransomware without confirmed leakage	What information was encrypted or blocked, and what are the database's security level and extent of impact?

1. Prepare your mapping, authority and contact channels

Map databases and systems

Owners: the business process owner and IT, with support from legal counsel. Map databases and the systems that display and export their information, including payroll, CRM and shared files. Evidence of completion: a mapping and classification document with a documented rationale, approved by the authorized person.

Assign decision-making and submission authority

Owner: management. Appoint an incident manager, an authorized decision maker, a submitter and a checker. Assign substitutes and establish an escalation path outside business hours as well, in line with service agreements. Include the data protection officer, if appointed. Evidence of completion: an approved procedure with names, authority and agreed availability.

Prepare emergency contacts and access

Owners: operations and IT. Keep contact details and a protected copy of the procedure available even when corporate email is unavailable. Test role-appropriate access to documents and evidence collection tools. Evidence of completion: a record of contact and access checks, with the date and the checker's name.

Check that staff can identify a database from a sample file, activate escalation without the manager, and open a readable evidence export. Also check that they can locate receipt confirmation and make a test call to the backup outside organizational email.

Define in contracts and procedures which suppliers update the business, who provides evidence and who verifies submission to the Authority; do not assume the supplier reported on your behalf. You can connect this to your business continuity and disaster recovery plan, so information handling and continued customer service rest on clear responsibilities.

2. Submit an initial report and document the submission

Gather the known information

Owner: the incident manager, with support from IT and suppliers. Distinguish facts, estimates and unresolved details. Gather organization and reporter details, database and supplier information, known dates and times, information types, estimated scope and containment actions. Evidence of completion: a dated draft with references to supporting evidence; mark an unknown scope as under investigation, rather than zero.

Decide and submit

Owners: the authorized decision maker and submitter, with support from legal counsel. Assess the information against the Authority's guidance and applicable law, and document the decision. When reporting is required, submit through the online service linked from the Authority's page. Evidence of completion: a reasoned decision and a copy of the information submitted.

Document submission and follow-up

Owners: the submitter and a second checker. Keep a record of submission and any confirmation of receipt, and follow the service's instructions if confirmation is missing. List unresolved details and assign responsibility for completing them. Evidence of completion: a submission record and a follow-up task list.

The Authority's service states that reporting must be immediate and refers to regulation 11(d). When the obligation applies, do not wait for a full investigation or the supplier's response: report what is known and mark what remains under investigation. Access the online submission service through the verified reporting service page. If the GDPR may also apply, request a separate legal assessment; deadlines under another law do not establish that you may delay reporting in Israel.

The initial report should distinguish known facts, estimates, and details not yet established, and convey that information through the official form. Once a known incident meets the definition of a serious security incident, reporting must not wait for the investigation to finish.

Copyable reporting template and completed example

Use the following fields as a working draft and adapt it to the submission fields linked from the Authority's service page. This fictional example is for exercises only; it does not describe a customer or determine that reporting is required.

Field	Example entry for an exercise
Organization and reporter	Example business; operations manager; business phone and email to be entered in the form
Database and supplier	Customer database; CRM export folder in SharePoint; supplier details under review
Discovery and incident start	Discovered today following an employee report; exact times and exposure start under investigation
Currently known	A link to a customer file permitted access without the intended restriction
Information and scope	Names and contact details; record and visitor counts not yet verified
Actions	Link revoked; configuration evidence preserved; log collection started
Uncertainty	Exposure duration, downloads and database affiliation under investigation
Follow-up and contact	Incident manager is coordinating findings; full contact details attached for further inquiries

3. Contain the incident and preserve evidence

Restrict risky access

Owner: the IT team or authorized supplier, in coordination with the incident manager. Disable an exposed link or block a compromised account as needed, and document changes without delaying necessary containment. Evidence of completion: a record of the action, who performed it, when it was performed and the state verified afterward.

Preserve technical records

Owner: the evidence collector designated in the procedure. Collect records using available tools and appropriate permissions, and record the source, collection time and collector's name for each item of evidence. Restrict access to the incident file. Evidence of completion: an evidence index and readable files in a protected incident folder.

Fix the issue and approve the return to normal operations

Owners: IT and the business process owner. Fix the root cause and verify that corrected permissions support normal work. The incident manager should gather findings for supplementary reporting as needed. Evidence of completion: a record of the fix, test results and approval from the process owner.

For a compromised Microsoft 365 account, follow Microsoft's guidance for responding to a compromised account, as appropriate for your environment and available permissions. Contacting the Israel National Cyber Directorate and its 119 hotline provides access to initial professional assistance, but does not replace reporting to the Privacy Protection Authority; neither does contacting the police. Assess separately with legal counsel whether customers and employees must be notified.

Copyable decision log

When	Fact or uncertainty	Decision and rationale	Owner	Evidence and follow-up
At discovery	Alert description and source	Open incident and escalate	Incident manager	Reference to original evidence
During reporting assessment	Database, classification and available information	Report or record a reasoned conclusion for reassessment	Authorized decision maker and legal counsel	Finding that could change the decision
After submission	What was reported and what is missing	Verify receipt and provide additional information	Submitter and checker	Submission record and open tasks

4. Test the procedure and close gaps

Run an exercise scenario

Owner: the incident manager, with participation from management, operations and IT or the supplier. Run an exercise in which an employee reports an open link while the regular incident manager is absent. Evidence of completion: an exercise log recording the time taken to escalate, identify the database, collect evidence and prepare a partial report. These are internal exercise metrics, not statutory deadlines.

Close gaps and verify fixes

Owner: the exercise leader. Assign an owner and completion date to each gap, update the procedure and contractual arrangements as needed, and retest the actions that failed. Evidence of completion: a gap list with verification results and management approval to close each gap.

Updated: 29.10.2026.

Data Security Incident Response Readiness

Talk to us about preparing to respond to a data security incident.

Talk to 1iT