Baker Tilly: connect the notice to the affected dataset
An incident notice needs to be connected to the datasets a business actually shares. A documented reconciliation helps establish what to investigate and who owns the next decision.
Portekizce okuBy Pentesty
Start with a document that can be checked
The Baker Tilly notice, dated November 9, reports that an unauthorized actor obtained client data held on a third-party platform. It dates incident awareness to September 6 and completion of its data review to October 28, 2026. The public template leaves individual information categories in a placeholder.
The template does not replace an individual notice or establish each recipient’s scope. This analysis is dated November 11, 2026; the document records earlier steps.
Reconcile the business operation before classifying scope
Choose a contracted service and record what your organization delivered: files, fields, purpose, channel and accountable owner. Use dataset names and internal identifiers, avoiding copies of personal information in the tracking sheet. The proposed result is a correspondence between the data’s origin and the system that received it. Validate the list with the service owner and document naming differences between the teams.
Ask the supplier for findings that allow that delivery to be compared with the investigated scope. An absent file might represent verified exclusion, a visibility gap or unfinished analysis. Record which interpretation is supported and who supports it. Do not turn missing evidence into an automatic security conclusion.
NIST SP 800-161 provides guidance for identifying, assessing and mitigating cybersecurity supply chain risks. Here, we turn that reference into a concrete deliverable: a row for each data flow, accessible supporting evidence and an owner for the next decision.
Build a record another team can review
A useful row can contain the contracted service, submitted dataset, relevant period, receipt evidence, current classification and person responsible for confirmation. Add the version of the notice consulted. When the supplier corrects its list, retain the previous version and explain which rows changed, preserving the investigation’s history.
Rehearse an authorized workflow using fictional data. Submit a test file, obtain its receipt and ask another person to find that delivery in the record. This exercise tests the proposed traceability. It does not establish what happened during the incident or demonstrate deletion of copies retained by the partner.
The analysis of supplier data deletion complements this review. Receipt, retention and disposal each need evidence appropriate to the stage being examined.
Close the work through a documented decision
Separate technical requests from communication decisions. The team comparing files needs to provide facts and limitations to internal decision makers; it should not improvise legal conclusions. In this proposed workflow, final classification requires acceptance by the dataset owner, references to evidence and treatment of open discrepancies.
For each unresolved item, write down the unanswered question and expected artifact: a corrected list, environment confirmation, transfer record or statement with a defined scope. Agree on an established channel for receiving it. Avoid resending personal documents simply to explain uncertainty about metadata.
The review of data and credentials at AI providers illustrates another part of this responsibility. The operational objective is to let someone resume the assessment and understand what is confirmed, what remains open and who can decide.
Frequently asked questions
Which document should guide the internal review?
Keep the version received by the organization, verify its origin through an established channel and connect it to the service used. A public template supplies context; the review needs the scope applicable to its recipient.
How can we avoid duplicating personal information?
Record internal identifiers and references to authorized repositories. Restrict access to original documents and use fictional samples to test how the evidence is organized.
Can one supplier statement close every open item?
Ask the statement to identify the systems, datasets and period covered. The internal owner evaluates whether that scope answers the outstanding questions and records remaining limitations.
What is the proposed completion criterion?
Each data flow has linked evidence, discrepancies have been addressed and an owner has accepted the result. Unconfirmed items remain visible, with an assigned person and a next step.
Sources and references
- Baker Tilly: November 9 notice filed in Massachusetts
- NIST: cybersecurity supply chain risk management
Original Pentesty analysis, published November 11, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.