Reporting · The disclosure rule · Element

The timing

How quickly disclosure must happen, and what starts the clock.

The part

What it is

The clock usually starts on becoming aware rather than on understanding, which is the distinction that catches organisations out.

Reporting before an investigation is complete is uncomfortable and is generally the right thing to do.

The smallest level

The attributes it carries

Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.