Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Breach Notification and Regulatory Reporting
The clock is running
Many laws now require organisations to report serious incidents and personal data breaches within days, sometimes hours. Missing the deadline can bring penalties on top of the breach itself. Notification has to be planned before the incident, not worked out during it. “Incident response communications (reporting, notification, escalation)” is a named CISM topic.
Common deadlines
| Requirement | Who to notify | Typical deadline |
|---|---|---|
| GDPR (EU / UK GDPR) | Supervisory authority; individuals if the risk to them is high | 72 hours from awareness |
| NIS2 (EU) | National CSIRT or competent authority | Early warning in 24 hours; report in 72 hours; final report in a month |
| DORA (EU financial sector) | Financial supervisor | Initial report within hours of classifying a major incident |
| SEC rules (US listed companies) | Public disclosure on Form 8-K | 4 business days after determining materiality |
| Contracts | Customers, card brands, partners | As agreed, often 24–72 hours |
Deadlines differ between regimes and change over time; legal counsel confirms which apply. A multinational incident can trigger several at once.
Who needs telling
Building notification into the plan
- Register every applicable requirement, by jurisdiction and sector.
- Triggers: classification criteria that start the clock.
- Escalate to legal immediately when a possible breach is identified.
- Templates: pre-drafted, legally reviewed notifications.
- Decide and send: legal leads; executives approve.
- Record what was notified, when, to whom and why.
Encrypted data may reduce or remove notification duties, but only if the keys weren’t compromised. Legal confirms.
Notify with what you know
Most regimes allow an initial notification with incomplete information, followed by updates. Waiting for certainty usually means missing the deadline.
Example. On day two of an investigation, the company knows customer records were accessed, but not how many. Legal notifies the data protection authority within 72 hours with what’s known, explains that the investigation is ongoing, and sends two updates as the scope becomes clear.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| GDPR notification deadline | 72 hours from awareness, to the supervisory authority |
| Who decides whether notification is required? | Legal counsel, with management |
| The investigation isn’t complete at the deadline | Notify with the known facts; update later |
| When the notification clock starts | Usually at awareness |
| Best preparation | A requirements register and a pre-approved process in the plan |
In short
- Laws, regulations and contracts can require notification of regulators, affected individuals, customers and partners within strict deadlines.
- Examples: GDPR (72 hours to the authority), NIS2 (24-hour early warning), DORA (financial sector), SEC (4 business days after materiality), and contract terms.
- The clock often starts at awareness, so fast classification and escalation are essential.
- Legal counsel leads notification decisions; the security manager supplies facts and builds the process into the plan.
- Initial notifications can be made with incomplete information and updated later.
- Records of what was known, decided and notified, and when, are evidence of compliance.
Exam traps
- Waiting for the investigation to finish before notifying usually misses the deadline.
- The security manager doesn't decide alone whether notification is legally required.
- Encrypted data may reduce or remove notification duties, but only if keys weren't compromised; legal confirms.
- Multinational incidents can trigger several regimes with different deadlines.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Common deadlines
Who needs telling