You're staring at next year's security budget, and the question isn't whether to invest in cybersecurity, but where. Do you fund systems that might prevent an incident, or processes that manage the aftermath when prevention fails?
This isn't an academic exercise. OneTouchPoint Corp. recently settled over a 2022 ransomware attack that exposed data of 2,651,396 individuals. The company committed to $2,000,000 in security enhancements over five years, plus up to $1,500,000 in legal fees, credit monitoring, and compensation to affected individuals. The attack lasted less than 48 hours, but the legal and operational consequences stretched across years.
Your decision isn't binary, but your budget forces prioritization. Here's how to decide where your next dollar goes.
Key Factors That Affect Your Choice
Your current control maturity determines your starting point. If you can't answer basic questions about network segmentation, privileged access management, or backup recovery time objectives, you're not ready to optimize breach notification workflows. You need foundational prevention controls first.
Regulatory obligations create a floor, not a ceiling. If you handle protected health information under the Health Insurance Portability and Accountability Act or personal data under state breach notification statutes, you must maintain minimum notification capabilities regardless of prevention investments. The question becomes whether you exceed those minimums or redirect resources to prevention.
Your threat profile matters more than your industry label. A healthcare vendor handling sensitive patient data faces different attack economics than a healthcare provider. OneTouchPoint processed high-value data that attracts targeted attacks. If your data has resale value or extortion potential, prevention controls deliver asymmetric returns.
The gap between detection and containment reveals your real risk. In the OneTouchPoint incident, the attacker accessed the network on April 27 and encrypted files by April 28. That's roughly 24 hours from initial access to impact. If your current detection capabilities wouldn't catch lateral movement within that window, your notification plan is a disaster recovery plan, not a risk mitigation strategy.
Path A: Prioritize Prevention When You Have Control Gaps
Choose this path if:
- You lack network segmentation between production systems and sensitive data repositories.
- Privileged accounts aren't managed through dedicated Privileged Access Management tools with session recording.
- You can't enforce multi-factor authentication across all remote access points.
- Backup systems reside on the same network as production systems.
- You haven't tested restoration from backups in the past 90 days.
What this looks like in practice: Your next budget cycle funds endpoint detection and response tools, implements the Principle of Least Privilege across service accounts, and deploys immutable backup infrastructure. You're building controls that would have stopped the OneTouchPoint attack during the initial access phase or limited lateral movement before encryption.
The regulatory connection: NIST Cybersecurity Framework (CSF) 2.0 Protect function and ISO/IEC 27001 Annex A controls 5.15 (access control), 8.3 (information backup), and 8.7 (protection against malware) address these fundamentals. If you can't demonstrate these controls during an audit, your Statement of Applicability has gaps that auditors will flag.
Budget reality: Prevention controls require upfront capital and ongoing operational costs. You're looking at tool licensing, integration work, staff training, and sustained monitoring. But the math changes when you consider that the consolidated lawsuit against OneTouchPoint asserted claims including negligence, breach of implied contract, and violations of state consumer protection laws, alleging the breach "should have been prevented" due to failure to implement reasonable cybersecurity measures.
Path B: Prioritize Notification Readiness When Prevention Is Mature
Choose this path if:
- You've implemented core NIST SP 800-53 or CIS Critical Security Controls and can demonstrate consistent operation.
- You maintain a Computer Security Incident Response Team with documented playbooks.
- Your last SOC 2 Type II audit showed no significant deficiencies in access controls or monitoring.
- You operate in jurisdictions with strict breach notification timelines (like the General Data Protection Regulation's 72-Hour Notification Requirement).
- Your incident response plan hasn't been tested against a scenario involving personally identifiable information or protected health information.
What this looks like in practice: You're funding forensic retainer agreements, automated notification platforms, legal counsel with breach response experience, and credit monitoring vendor relationships. You're building capabilities that determine whether you notify 2,651,396 individuals efficiently or face additional legal exposure for inadequate notification.
The regulatory connection: Health Information Technology for Economic and Clinical Health Act breach notification requirements, HIPAA Privacy Rule provisions, and state breach notification statutes impose specific timelines and content requirements. If you handle health information and report to the HHS' Office for Civil Rights, your notification process must account for individual notifications, media notifications (if the breach affects more than 500 residents of a state), and regulatory reporting, each with different deadlines.
Budget reality: Notification readiness is cheaper than prevention infrastructure but becomes expensive during an actual incident. OneTouchPoint's settlement included costs for two-year credit monitoring subscriptions with $1 million identity theft insurance policies for the monetary relief class, plus compensation for documented losses up to $5,000 per class member. Those costs scale with the number of affected individuals, and you won't know that number until you're in the middle of an incident.
Path C: Hybrid Investment in Detection and Response
Choose this path if:
- Your prevention controls meet baseline requirements but you lack visibility into whether they're working.
- You can't answer "how long would an attacker have access before we detected them?"
- Your incident response plan exists but hasn't been tested against realistic attack scenarios.
- You're operating in a regulated environment that will scrutinize both your prevention efforts and your response timeline.
What this looks like in practice: You're funding security information and event management platforms, threat hunting capabilities, and tabletop exercises that test both technical detection and notification procedures. You're building the muscle memory that determines whether you identify unauthorized access in 24 hours or 24 days.
Why this matters: The OneTouchPoint attacker moved from initial access to encryption in roughly 24 hours. Your detection window determines whether you're containing an incident or managing a breach. ISO/IEC 27001 control 5.24 (information security incident management planning and preparation) and control 5.25 (assessment and decision on information security events) exist because the gap between "something happened" and "we know something happened" determines your response options.
Summary Matrix
| Factor | Prevention Priority | Notification Priority | Hybrid Approach |
|---|---|---|---|
| Control maturity | Gaps in foundational controls | Mature baseline, documented in recent audits | Baseline controls present but unmonitored |
| Regulatory driver | Prescriptive security requirements (NIST SP 800-171, HIPAA Security Rule) | Strict notification timelines (72-Hour Notification Requirement) | Both security and notification obligations |
| Threat profile | High-value data, targeted attacks likely | Commodity attacks, notification compliance risk higher than breach likelihood | Moderate threat, uncertain attack patterns |
| Detection capability | Can't identify lateral movement within 48 hours | Can detect and contain, need notification efficiency | Unclear time-to-detection |
| Budget constraint | Capital available for infrastructure | Operating budget for services and retainers | Limited capital, prefer operational spending |
| Recent audit findings | Significant deficiencies in access controls or monitoring | No significant findings, but incident response untested | Technical controls adequate, process gaps evident |
The OneTouchPoint settlement shows that "we have a notification plan" doesn't satisfy negligence claims when plaintiffs argue the breach was preventable. But prevention without detection creates a false sense of security. You won't know your controls failed until you're issuing notifications.
Your budget forces a choice, but the choice isn't permanent. Build prevention first if you have control gaps. Build notification readiness if your controls are mature but untested. Build detection if you're unsure whether your prevention controls are working. Just don't confuse having a notification plan with having a security program.
