Does your organization have documented breach notification procedures that include a process for notifying affected customers in the event of a data breach?
Explanation
Breach notification is the concern: whether you maintain documented procedures that include a clear process for notifying affected customers when a data breach occurs. Effective breach notification procedures should define roles and responsibilities, timeframes for notification, communication templates, and compliance with relevant data protection regulations (such as GDPR, CCPA, or industry-specific requirements).
Evidence could include a documented breach response plan or incident response playbook that outlines the notification process, sample notification templates, a decision tree for determining notification requirements, and records of breach notification drills or exercises conducted by the organization.
Implementation Example
Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers
ID: RS.CO-02.330
Context
- Function
- RS: RESPOND
- Category
- RS.CO: Incident Response Reporting and Communication
- Sub-Category
- Internal and external stakeholders are notified of incidents
Related questions
- Do personnel understand their specific roles, responsibilities, and the order of operations during a security incident response?
- Does your organization have documented procedures for notifying business partners and customers of security incidents in accordance with contractual obligations?
- Does your organization have documented procedures for notifying law enforcement and regulatory bodies of security incidents that include specific notification criteria and required management approvals?
- Does your organization have documented processes for securely sharing information during incident response that align with established information sharing agreements?
- Does your organization voluntarily share information about observed threat actor tactics, techniques, and procedures (TTPs) with an Information Sharing and Analysis Center (ISAC) or similar industry group after removing sensitive data?
- Does your organization have a documented process for notifying HR when malicious insider activity is detected?