Breach Notification System

yarn add @tantainnovative/ndpr-toolkit

import { useState, useEffect } from 'react';
import { 
  BreachReportForm, 
  BreachRiskAssessment, 
  BreachNotificationManager,
  RegulatoryReportGenerator
} from '@tantainnovative/ndpr-toolkit';

// Define breach categories
const breachCategories = [
  { id: 'unauthorized-access', label: 'Unauthorized Access' },
  { id: 'data-loss', label: 'Data Loss' },
  { id: 'system-compromise', label: 'System Compromise' },
  { id: 'phishing', label: 'Phishing Attack' },
  { id: 'other', label: 'Other' }
];

// Organization information
const organizationInfo = {
  name: 'Example Company Ltd.',
  address: '123 Main Street, Lagos, Nigeria',
  dpoName: 'John Doe',
  dpoEmail: 'dpo@example.com',
  dpoPhone: '+234 123 456 7890'
};

// Sample breach service (replace with your actual data service)
const breachService = {
  breaches: [],
  
  reportBreach: (breachData) => {
    const newBreach = {
      ...breachData,
      id: `breach-${Date.now()}`,
      status: 'reported',
      reportedAt: new Date(),
      riskAssessment: null,
      notifications: [],
      regulatoryReport: null
    };
    breachService.breaches.push(newBreach);
    return newBreach;
  },
  
  getBreaches: () => {
    return breachService.breaches;
  },
  
  getBreachById: (id) => {
    return breachService.breaches.find(breach => breach.id === id);
  },
  
  updateBreachStatus: (id, status) => {
    const breach = breachService.breaches.find(breach => breach.id === id);
    if (breach) {
      breach.status = status;
      breach.updatedAt = new Date();
    }
    return breach;
  },
  
  saveRiskAssessment: (id, assessment) => {
    const breach = breachService.breaches.find(breach => breach.id === id);
    if (breach) {
      breach.riskAssessment = assessment;
      breach.updatedAt = new Date();
      
      // Update status based on risk level
      if (assessment.riskLevel === 'high') {
        breach.status = 'high-risk';
      } else if (assessment.riskLevel === 'medium') {
        breach.status = 'medium-risk';
      } else {
        breach.status = 'low-risk';
      }
    }
    return breach;
  },
  
  recordNotification: (id, notification) => {
    const breach = breachService.breaches.find(breach => breach.id === id);
    if (breach) {
      breach.notifications.push({
        ...notification,
        id: `notification-${Date.now()}`,
        sentAt: new Date()
      });
      breach.updatedAt = new Date();
      
      // Update status if all required notifications are sent
      if (breach.notifications.length >= breach.riskAssessment.requiredNotifications.length) {
        breach.status = 'notifications-complete';
      }
    }
    return breach;
  },
  
  saveRegulatoryReport: (id, report) => {
    const breach = breachService.breaches.find(breach => breach.id === id);
    if (breach) {
      breach.regulatoryReport = {
        ...report,
        generatedAt: new Date()
      };
      breach.status = 'report-generated';
      breach.updatedAt = new Date();
    }
    return breach;
  }
};

// Breach reporting form component
function BreachReportingPage() {
  const [submitted, setSubmitted] = useState(false);
  const [currentBreach, setCurrentBreach] = useState(null);
  
  const handleSubmitBreachReport = (breachData) => {
    const newBreach = breachService.reportBreach(breachData);
    setCurrentBreach(newBreach);
    setSubmitted(true);
  };
  
  const handleRiskAssessmentComplete = (assessment) => {
    const updatedBreach = breachService.saveRiskAssessment(currentBreach.id, assessment);
    setCurrentBreach(updatedBreach);
  };
  
  return (
    <div>
      <h1>Data Breach Reporting</h1>
      
      {!submitted ? (
        <>
          <p>
            Use this form to report a suspected data breach. All breaches must be
            reported internally within 24 hours of discovery.
          </p>
          
          <BreachReportForm 
            onSubmit={handleSubmitBreachReport}
            categories={breachCategories}
          />
        </>
      ) : (
        <div>
          <h2>Breach Reported</h2>
          <p>
            The breach has been reported successfully. Reference number: <strong>{currentBreach.id}</strong>
          </p>
          
          <h3>Risk Assessment</h3>
          <p>
            Please complete the risk assessment to determine notification requirements.
          </p>
          
          <BreachRiskAssessment 
            breachData={currentBreach}
            onComplete={handleRiskAssessmentComplete}
          />
          
          {currentBreach.riskAssessment && (
            <div>
              <h3>Risk Assessment Complete</h3>
              <p>
                Risk Level: <strong>{currentBreach.riskAssessment.riskLevel}</strong>
              </p>
              <p>
                {currentBreach.riskAssessment.requiresNitdaNotification 
                  ? 'NITDA notification is required within 72 hours.' 
                  : 'NITDA notification is not required.'}
              </p>
              <p>
                {currentBreach.riskAssessment.requiresDataSubjectNotification 
                  ? 'Data subject notification is required without undue delay.' 
                  : 'Data subject notification is not required.'}
              </p>
            </div>
          )}
        </div>
      )}
    </div>
  );
}

// Breach management dashboard component
function BreachManagementDashboard() {
  const [breaches, setBreaches] = useState([]);
  const [selectedBreach, setSelectedBreach] = useState(null);
  
  useEffect(() => {
    // Load breaches from service
    setBreaches(breachService.getBreaches());
  }, []);
  
  const handleUpdateStatus = (id, status) => {
    const updatedBreach = breachService.updateBreachStatus(id, status);
    setBreaches(breachService.getBreaches());
  };
  
  const handleSendNotification = (id, notification) => {
    const updatedBreach = breachService.recordNotification(id, notification);
    setBreaches(breachService.getBreaches());
  };
  
  const handleGenerateReport = (id, report) => {
    const updatedBreach = breachService.saveRegulatoryReport(id, report);
    setBreaches(breachService.getBreaches());
    setSelectedBreach(updatedBreach);
  };
  
  return (
    <div>
      <h1>Breach Management Dashboard</h1>
      
      <BreachNotificationManager 
        breaches={breaches}
        onUpdateStatus={handleUpdateStatus}
        onSendNotification={handleSendNotification}
        onSelectBreach={setSelectedBreach}
      />
      
      {selectedBreach && selectedBreach.riskAssessment && 
       selectedBreach.riskAssessment.requiresNitdaNotification && (
        <div>
          <h2>Regulatory Report Generator</h2>
          <p>
            Generate a NITDA breach notification report for submission.
          </p>
          
          <RegulatoryReportGenerator 
            breachData={selectedBreach}
            organizationInfo={organizationInfo}
            onGenerate={(report) => handleGenerateReport(selectedBreach.id, report)}
          />
        </div>
      )}
    </div>
  );
}

type BreachReport = {
  id?: string;
  title: string;
  category: string;
  description: string;
  discoveredAt: Date;
  reportedBy: {
    name: string;
    email: string;
    department: string;
  };
  affectedSystems: string[];
  affectedDataTypes: string[];
  estimatedImpact: string;
  initialActions: string;
  status?: string;
  reportedAt?: Date;
  updatedAt?: Date;
};

export interface BreachReport {
  /**
   * Unique identifier for the breach report
   */
  id: string;
  
  /**
   * Title/summary of the breach
   */
  title: string;
  
  /**
   * Detailed description of the breach
   */
  description: string;
  
  /**
   * Category of the breach
   */
  category: string;
  
  /**
   * Timestamp when the breach was discovered
   */
  discoveredAt: number;
  
  /**
   * Timestamp when the breach occurred (if known)
   */
  occurredAt?: number;
  
  /**
   * Timestamp when the breach was reported internally
   */
  reportedAt: number;
  
  /**
   * Person who reported the breach
   */
  reporter: {
    name: string;
    email: string;
    department: string;
    phone?: string;
  };
  
  /**
   * Systems or data affected by the breach
   */
  affectedSystems: string[];
  
  /**
   * Types of data involved in the breach
   */
  dataTypes: string[];
  
  /**
   * Estimated number of data subjects affected
   */
  estimatedAffectedSubjects?: number;
  
  /**
   * Whether the breach is ongoing or contained
   */
  status: 'ongoing' | 'contained' | 'resolved';
}

export interface RiskAssessment {
  /**
   * Unique identifier for the risk assessment
   */
  id: string;
  
  /**
   * ID of the breach this assessment is for
   */
  breachId: string;
  
  /**
   * Timestamp when the assessment was conducted
   */
  assessedAt: number;
  
  /**
   * Person who conducted the assessment
   */
  assessor: {
    name: string;
    role: string;
    email: string;
  };
  
  /**
   * Confidentiality impact (1-5)
   */
  confidentialityImpact: number;
  
  /**
   * Integrity impact (1-5)
   */
  integrityImpact: number;
  
  /**
   * Availability impact (1-5)
   */
  availabilityImpact: number;
  
  /**
   * Likelihood of harm to data subjects (1-5)
   */
  harmLikelihood: number;
  
  /**
   * Severity of potential harm to data subjects (1-5)
   */
  harmSeverity: number;
  
  /**
   * Overall risk score
   */
  overallRiskScore: number;
  
  /**
   * Risk level based on the overall score
   */
  riskLevel: 'low' | 'medium' | 'high' | 'critical';
  
  /**
   * Whether the breach is likely to result in a risk to the rights and freedoms of data subjects
   */
  risksToRightsAndFreedoms: boolean;
}

export interface NotificationRequirement {
  /**
   * Whether NITDA notification is required
   */
  nitdaNotificationRequired: boolean;
  
  /**
   * Deadline for NITDA notification (72 hours from discovery)
   */
  nitdaNotificationDeadline: number;
  
  /**
   * Whether data subject notification is required
   */
  dataSubjectNotificationRequired: boolean;
  
  /**
   * Justification for the notification decision
   */
  justification: string;
}

// Import the hook
import { useBreach } from '@tantainnovative/ndpr-toolkit';

// Use the hook in your component
const { 
  breaches,               // Array of all breach reports
  submitBreachReport,     // Function to submit a new breach report
  updateBreachReport,     // Function to update an existing breach report
  performRiskAssessment,  // Function to perform a risk assessment
  determineNotificationRequirements,  // Function to determine notification requirements
  generateRegulatoryReport,  // Function to generate a report for NITDA
  getBreachById,          // Function to get a breach by ID
} = useBreach();

// Submit a new breach report
const newBreachReport = submitBreachReport({
  title: 'Unauthorized Database Access',
  description: 'An unauthorized IP address accessed our customer database.',
  category: 'unauthorized-access',
  discoveredAt: Date.now(),
  occurredAt: Date.now() - 3600000, // 1 hour ago
  reporter: {
    name: 'John Doe',
    email: 'john@example.com',
    department: 'IT Security',
    phone: '1234567890'
  },
  affectedSystems: ['customer-database'],
  dataTypes: ['personal-information', 'contact-details'],
  estimatedAffectedSubjects: 500,
  status: 'contained'
});

// Perform a risk assessment
const riskAssessment = performRiskAssessment({
  breachId: newBreachReport.id,
  assessor: {
    name: 'Jane Smith',
    role: 'Data Protection Officer',
    email: 'jane@example.com'
  },
  confidentialityImpact: 4,
  integrityImpact: 3,
  availabilityImpact: 2,
  harmLikelihood: 3,
  harmSeverity: 4
});

// Determine notification requirements
const requirements = determineNotificationRequirements({
  breachId: newBreachReport.id,
  riskAssessmentId: riskAssessment.id
});

// Generate a regulatory report for NITDA
if (requirements.nitdaNotificationRequired) {
  const report = generateRegulatoryReport({
    breachId: newBreachReport.id,
    riskAssessmentId: riskAssessment.id
  });
}