Playbook for Legal Request

  • Release version: Yokohama
  • Updated January 30, 2025
  • 1 minute to read

    • The Legal Request playbook provides step-by-step guidance on how you can inform legal about the latest summary of an MSI so that they can notify the SEC in the 4-day time frame that is required for material breaches.

    Overview

    As an Incident Manager, you can use the Legal Request playbook to inform the legal team about the latest summary of an MSI so that they can notify the SEC for material breaches. You can use the Process Automation Designer (PAD) templates to perform the steps in the Legal Request playbook and inform the Legal team accordingly.

    This playbook can be used if a major security incident is created or updated. You need to activate the Legal Request playbook on PAD and then perform all the tasks, such as analysis, contain, eradicate, and review.

    The following are the lanes of the process definition and correspond to the major security incident state:
    • Analysis
    • Contain
    • Eradicate
    • Review

    Each lane has certain activities within it.

    Figure 1. Playbook for Legal Request
    Playbook for Legal Request

    Once you mark a task complete in a lane, you can move to the next task. You can save a task at any point in time and return to the playbook at a later date and time. After you complete all the tasks in a lane, you can move to the next lane. The status is reflected in the left-hand panel as you keep completing tasks and lanes. An Activity Log on the right-hand side of the playbook shows all the data that you have entered for each task.

    After you complete all the tasks, you’re asked to review the details you entered in all the lanes. You can choose to edit any field or select Finish to complete the process of creating the entitlement.