Incident response · The response plan · Element
The notifications
Who must be told, within how long, and what starts the clock.
The part
What it is
Regulators, customers, insurers and partners each have different deadlines and different triggers, and they need listing before the day they apply.
An interim notification with incomplete information is generally acceptable and generally better than a late complete one.
The smallest level
The attributes it carries
Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.
Clock starts on
Awareness rather than understanding, which is what catches organisations out.
Text shared type
The other elements in the response plan
The containment
What is done first to stop the harm.
LearnThe roles
Who does what during an incident.
Learn