Does your organization have documented procedures for notifying law enforcement and regulatory bodies of security incidents that include specific notification criteria and required management approvals?
Explanation
Engaging the authorities is the concern here: whether you have documented procedures, with clear criteria and required approvals, for notifying law enforcement and regulators of security incidents. Proper notification procedures ensure timely reporting to law enforcement and regulatory bodies when legally required or when external assistance is needed, while ensuring appropriate management oversight of these communications.
Evidence could include a section of your incident response plan that outlines notification thresholds (e.g., data breach size, incident type, regulatory requirements), the approval chain required before external notification, contact information for relevant authorities, and documentation templates for different types of notifications.
Implementation Example
Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval
ID: RS.CO-02.332
Context
- Function
- RS: RESPOND
- Category
- RS.CO: Incident Response Reporting and Communication
- Sub-Category
- Internal and external stakeholders are notified of incidents
Related questions
- Do personnel understand their specific roles, responsibilities, and the order of operations during a security incident response?
- Does your organization have documented breach notification procedures that include a process for notifying affected customers in the event of a data breach?
- Does your organization have documented procedures for notifying business partners and customers of security incidents in accordance with contractual obligations?
- Does your organization have documented processes for securely sharing information during incident response that align with established information sharing agreements?
- Does your organization voluntarily share information about observed threat actor tactics, techniques, and procedures (TTPs) with an Information Sharing and Analysis Center (ISAC) or similar industry group after removing sensitive data?
- Does your organization have a documented process for notifying HR when malicious insider activity is detected?
