Business Core · Compliance · Module
Incident response
What happens when something goes wrong — containment, notification and correction — decided in advance rather than during.
The idea
How it works
Notification deadlines are short and they start when the organisation becomes aware, not when it finishes investigating. Working out who decides and who notifies while the clock runs is how deadlines are missed.
The instinct during an incident is to establish what happened before telling anyone. Where a regulatory deadline applies, that instinct is the failure mode, and it converts a containable incident into a compliance breach on top of it.
Working with it
In practice
- 01
Define what counts as an incident
Written in advance, so recognising one is not itself a judgement call under pressure.
- 02
Know the notification deadlines
Who must be told, within how long, and what the clock starts on.
- 03
Contain before investigating
Stop the harm first. Understanding it fully can follow.
- 04
Rehearse it
A plan first read during an incident is being written during an incident.
One level in
The components of incident response
A component is something that exists afterwards which did not exist before — a deliverable or a mechanism, not an intention.
The notification clock starts when you become aware, not when you understand. Contain, notify, then investigate.
The other modules in compliance
Regulatory mapping
Establishing which rules actually apply — by jurisdiction, sector and activity — before deciding how to meet them.
LearnControls
The mechanisms that make compliance happen — built into how work is done, rather than checked afterwards.
LearnMonitoring
Checking that controls are actually operating, independently of the people who operate them.
Learn