Does your organization have documented procedures for notifying law enforcement and regulatory bodies of security incidents that include specific notification criteria and required management approvals?

This question assesses whether your organization has formalized when and how to engage external authorities during security incidents. Proper notification procedures ensure timely reporting to law enforcement and regulatory bodies when legally required or when external assistance is needed, while ensuring appropriate management oversight of these communications. Evidence could include a section of your incident response plan that outlines notification thresholds (e.g., data breach size, incident type, regulatory requirements), the approval chain required before external notification, contact information for relevant authorities, and documentation templates for different types of notifications.