When an adversary steals an organization’s documents, the first loss is the data. The second comes days later, when someone else decides what those documents mean. A leaked line such as “risk accepted; patch deferred to next quarter” reads as negligence to anyone who cannot see why it was written, who approved it, what else was considered, and when the decision was due to be revisited. The organization usually knows the answer. What it often cannot do, quickly and in public, is prove it.
That makes a breach a cognitive security problem as much as a technical one. Hack-and-leak operations work because stolen records are fragments, and fragments invite interpretation. Whoever supplies the first coherent interpretation tends to keep the audience. My argument is that the strongest defense against this is not a better statement drafted after the leak, but a better decision record written long before it: one that an outsider could read cold and reconstruct accurately. I call that property decision provenance.
Figure: the same leaked line, with and without decision provenance. Hypothetical example; image created by the author.
The fragment problem
The 2017 French presidential election remains one of the best-documented cases. According to Jean-Baptiste Jeangène Vilmer’s post-mortem for the Atlantic Council and France’s IRSEM, about 15 gigabytes of data stolen from Emmanuel Macron’s campaign staff, including 21,075 emails, was released on Friday, May 5, 2017, two days before the final round of voting. The campaign said that those circulating the files had added fake documents to the authentic ones “to sow doubt and disinformation.” A journalist later estimated that only around 80 percent of the dump was genuine.
Two details from that case matter well beyond politics. First, the attackers did not need every document to be damaging. They needed volume, timing and ambiguity, so that readers would fill the gaps themselves. Second, the campaign’s own defense partly used that ambiguity: one of Macron’s colleagues later said that obvious forgeries let the team pass off a real email as fake. That may have suited a campaign operating under an electoral silence period. It is not a model for a company, an agency or a hospital. An institution that answers a leak by blurring what is real spends credibility it will need for the next incident.
The same mechanics now run through criminal extortion. The #StopRansomware Guide published by CISA, the FBI, the NSA and the MS-ISAC describes actors who exfiltrate victim data and threaten to release it, sometimes as their only form of extortion. The leverage in that model is interpretive: what will customers, regulators and reporters make of these files? A stolen exception approval, vulnerability ticket or board paper is exactly the kind of document that loses its meaning once it is separated from its context.
Why the second loss happen
Corrections are weak against first impressions. Stephan Lewandowsky and colleagues’ 2012 review of misinformation research describes a continued influence effect: people keep relying on misinformation even after it has been retracted. Among the remedies the review summarizes, one matters most for security leaders. A retraction works better when an alternative account fills the gap the misinformation leaves. Saying “that is misleading” leaves a hole. Explaining what actually happened, specifically and credibly, closes it.
This is where most organizations struggle. The true account of a risk decision rarely lives in one place. The trigger sits in a scanner report, the approval in an email thread, the options in a meeting nobody minuted, the evidence in a ticket that has since been closed and the review date in one person’s memory. Some of those people have moved on. Under pressure, the communications team can wait while engineers reassemble the story, or speak before the facts are checked and risk being contradicted by the next tranche of the leak. Both choices hand time to the adversary.
NIST’s incident response guidance already treats public communication as part of the response. Special Publication 800-61 Revision 3 groups it with incident coordination, notification and information sharing, and recommends that organizations have coordination mechanisms in place before they are needed. What no guidance can supply is the substance of those communications. That has to come from records the organization created when nobody outside was reading them.
Decision provenance as defensive information
A record has decision provenance when it carries enough of its own context that a qualified stranger can tell why the decision was made. In a practitioner guide I wrote for CertArc, I group the essential context into five elements under the label TRACE:
- Trigger: what changed, and what decision it forced.
- Responsibility: who held the authority, and who carried out, checked and monitored the result.
- Alternatives: the realistic options and what each would have cost.
- Chain of evidence: what was verified, what was assumed, and where the proof is kept.
- Expiry: the date or event that reopens the decision.
None of this is new governance. The NIST Cybersecurity Framework 2.0 describes its Govern function as a risk management strategy, expectations and policy that are “established, communicated, and monitored,” and NIST IR 8286 Revision 1 explains how cybersecurity risk registers feed enterprise risk management. What changes is the standard applied to the record. Most reviews ask whether a decision was approved. Provenance asks whether the record, on its own, would survive a reader with no reason to be charitable.
Return to the deferred patch, now as a hypothetical record. With provenance, the same leaked page would show that a vendor advisory and a confirmed scan triggered the decision; that the accountable service owner chose temporary access restrictions and closer monitoring over an untested emergency change; that the scan results and rollback test were on file; and that the deferral would end at the next emergency change window or at the first sign of attempted exploitation. A hostile reader can still dispute that choice. What becomes much harder is presenting it as indifference, because the page already contains the alternative account that a correction would otherwise have to supply.
Provenance also complicates forgery. A fabricated document inserted into a leak has to imitate more than letterhead. It has to reproduce the record structure that genuine decisions carry: reference numbers, linked evidence, named approvers and review conditions that can be checked against other systems. The more consistently an organization records its decisions, the easier it becomes to show which documents do not fit, and to show it with evidence rather than assertion.
Two tests to run before a leak
The first is a blind reconstruction test. Take a completed decision record and give it to a qualified colleague who was not involved. Withhold the meeting notes and any verbal briefing, and ask them to explain the five elements back in plain language. Then compare their account with what the decision owner intended. Gaps appear quickly, and they appear as specific missing elements rather than a vague sense that documentation could be better.
The second is a hostile reading. Give a different reviewer the same record and one instruction: write the most damaging headline you can that is still accurate, using this page alone. Then check whether the record already holds the answer. If the headline is “Company knew of critical flaw and chose not to fix it,” the record should show who held authority, what containment was applied instead, what evidence showed it was working and what condition would have ended the delay. If the record cannot answer its own worst headline, the organization has found its next communications problem before an adversary did.
Start with a small sample, perhaps a dozen recent risk acceptances or policy exceptions, and note which element fails most often. That element is the one to fix first, both in the template and in the habits of the people who complete it.
Limits
Provenance does not make a poor decision sound. If a risk was accepted for convenience, a clear record will show that too; the benefit is that the organization learns it from its own review rather than from a leak. Records written with a hostile reader in mind should be factual and dated, because speculation, blame and informal commentary inside decision records are a liability of their own. Some records will be privileged or classified, so legal and security owners should decide what is held where. Nothing here replaces an incident response plan, a risk register or the advice of counsel. It makes each of them faster to use under pressure.
The advantage that is built before the breach
Information professionals often measure advantage in contested environments by speed and reach. For an organization whose files have just been stolen, the advantage is narrower and more decisive: the ability to tell the true story first, completely and with documents that hold up. That capability is built or lost long before any breach, one decision record at a time. A useful question for any leadership team follows from it: if your last ten risk decisions were published tomorrow, could a stranger tell why you made them?
About the author
Swaminadhan Jagadeesan is a technical content writer at CertArc, an independent study platform for security, audit and AI governance certifications, and holds the CISM, AAISM and PMP certifications. The TRACE worksheet and reconstruction test described in this article are published at https://certarc.com/security/cyber-risk-decision-handoff.
References
Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, National Security Agency, & Multi-State Information Sharing and Analysis Center. (2023). #StopRansomware guide. https://www.cisa.gov/stopransomware/ransomware-guide
Jagadeesan, S. (2026). Cyber-risk decisions that survive the handoff: TRACE worksheet and reconstruction test. CertArc. https://certarc.com/security/cyber-risk-decision-handoff
Jeangène Vilmer, J.-B. (2019). The “Macron Leaks” operation: A post-mortem. Atlantic Council and IRSEM. https://www.atlanticcouncil.org/in-depth-research-reports/report/the-macron-leaks-operation-a-post-mortem/
Lewandowsky, S., Ecker, U. K. H., Seifert, C. M., Schwarz, N., & Cook, J. (2012). Misinformation and its correction: Continued influence and successful debiasing. Psychological Science in the Public Interest, 13(3), 106–131. https://doi.org/10.1177/1529100612451018
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST SP 800-61r3). https://doi.org/10.6028/NIST.SP.800-61r3
Quinn, S., Chua, J., Ivy, N., Gardner, R. K., Scarfone, K., Smith, M. C., & Witte, G. (2025). Integrating cybersecurity and enterprise risk management (ERM) (NIST IR 8286r1). https://doi.org/10.6028/NIST.IR.8286r1